Move "buckets for session" logic to Permissions