Hotfix: Route-level permission validation.