Let POST /models and PUT /models/:model_id handle permissions configuration.