Maybe <code>permissions</code> should be set before calling <code>save()</code>