This is not correct. Make helper functions for these on the controller that utilize `annotator.plugins.Permissions.authorize(action, annotation, user)`.