Don't repeat permissions in authorization rules