oh, right, it's the permissions of the user roles you send to it, mea culpa