revisit cascading permission design+priority