Use default value for `permission` on `PermissionError`
Don't stack checks for individual fields on top of `update`; need to check this for adverse effects?