minimal permissions