Flexible Rails permissioning engine