I think permissions should almost certainly be a property of the user that gets passed around, rather than it's own field.