permission checks, order queries