use symbolic names for access permissions