Add tests for permissions.permits()