Add some inline doc on permission criteria handling