How is the client populating the email address and/or first last name of the permission? Does the client not have a user id to provide instead?