Permissions refactor

cc @fancyremarker