Correctly propagate permissions via overlay to sub resources. Abstract max domains per user
to be max_gears OR 1 if they are on the free plan