you should have `permissions=None` and then the first line be `permissions = permissions or []`. that array gets scoped at the module level and if it got edited as `self.permissions` this would have very surprising behavior.