Fix RBAC and add support for user selected permissions