commit before refactoring permissions
made permissions its own object