Shouldn't you check what is being passed in as `$permissions`?