Empty string is still a string :-) You don't know how programmatically computed permissions may end up looking like.