Add permission check and correct filter condition.