interesting though that the sandbox one doesn't have that permission either, but it works without it