set minimal permissions for each workflow