create permission should check parts+status