[support] understanding per-node permissions