set permission restrictions