Alternatively, we may as well generate the reverse mapping of this -- map each perm to all permissions that imply that perm. Then `user_has_perm` only needs to do a single lookup to get the list of relevant permissions to filter by.