Tidy up Permission model to use more SQLAlchemy rather than hardcoded SQL.