#386 Reused user-entity permission method and moved part to service layer