should verify permission in method class not manager class