Add spec tests for object-level permissions