FIX: permission check broken