It wasn't my intention for AllowedActions to be hardcoded. It merely defines the signature by which to get the permissions for the user in a similar manner that User information is retrieved. I'll work on making it more general as per you suggestions.