can we return a list of permissions instead of a combined string?