Re-write core to support permissions and nested auth items