Fix principal search + refactor effective_perms (OMS-271)