fixed staff permissions