use allowy for permissions for apps
refactor access specs to be more declarative