Perhaps what's really needed is a Permission deserializer?