Add any derived permissions only when the user has the permission from which they are derived (plus test)