do we have kinds on the delegation permission string? maybe we should. or default to kind=1 unless specified.