Make permissions cache client-level