diff --git a/src/permission/fs_permission.cc b/src/permission/fs_permission.cc
index 05efc790f0c853..7a8a0ba2511d4b 100644
--- a/src/permission/fs_permission.cc
+++ b/src/permission/fs_permission.cc
@@ -89,7 +89,7 @@ void FSPermission::Apply(const std::string& allow, PermissionScope scope) {
   }
 }
 
-void FSPermission::GrantAccess(PermissionScope perm, std::string res) {
+void FSPermission::GrantAccess(PermissionScope perm, const std::string& res) {
   const std::string path = WildcardIfDir(res);
   if (perm == PermissionScope::kFileSystemRead) {
     granted_in_fs_.Insert(path);
diff --git a/src/permission/fs_permission.h b/src/permission/fs_permission.h
index 93c427276139fd..f393c6a042e662 100644
--- a/src/permission/fs_permission.h
+++ b/src/permission/fs_permission.h
@@ -130,7 +130,7 @@ class FSPermission final : public PermissionBase {
   };
 
  private:
-  void GrantAccess(PermissionScope scope, std::string param);
+  void GrantAccess(PermissionScope scope, const std::string& param);
   void RestrictAccess(PermissionScope scope,
                       const std::vector<std::string>& params);
   // fs granted on startup