add tests for confirming adding a permission updates visible_to for a permission.
don't store an empty object by default, just check for null
don't check in storage