Permission for item list ajax