push more permissions stuff up so it's used in the API