Process permissions after fetch as well

Re-calculate the permission ACL post-fetch to take account of
any template-defined permissions that depend on the model's data.