How do you implement the permission scoping to the step? Do you have any shareable code or examples?