restricting permissions on card names+status