Enforce permission checks on list and delete

fix(virtual): enforce permission checks on list and delete