initial implementation of permission api