reusable workflow permissions