Add permissions check to internal consume handler.

Signed-off-by: Mike Howe <dockter@almuramc.com>