set permissions for expense approvals