Understanding permissions in collections