recrypt now uses existing perms