Update docs on object-level permissions.

Closes #801.