Lovely!

How should we expose permission checking to the client app so that it can show/hide links when appropriate?