Add permissions to the membership api