limit 'current permissions' to those assigned directly to user, or those attached to groups belonging to the current organization