require_permissions takes array of ORed permissions