basically, we recommend pointing to an aliased permission