More work on permissions, some front-end