permission clean-up