Rework permissions

Attempting to generalize for records/measures, but still not happy with it.  It
does at least seem simpler this way.