if you want to do it via check permission, you'll need to write a wildcard for the "empty" case