add nested field for permissions model serializer