Refactored permission logic