records will now return proper records based on permission