revisit cascading permission design+status