Added model <Department> with API and permission checks