mod: permission propagation