I suppose I can live with that - although I might argue that this isn't a re-factoring so much as trying to be consistent with our current Authorization layer that provides an abstraction around these types of elements. Which, if we do the new permissions correctly should for the most part hold up and only the Authorization layer implementation would need to change.