Add permissions for controller actions