permission api should be clearer+status