Another case for having a `permissions` accessor on the `User` model is here: once it's behind a method on the User object, you can just return here the list of permissions instead of having a dedicated group.