even if it is just `permission view = role1`