the difference in what you posted vs what I have is that I'm using the permission in the relationship, and you're using a relation only