Then use work-based permissions