store the permissions in an object in the collection

That way we can have multiple permissions for each user/instance
relationship
POC version of admin accounts list page