Rewrite section on permission model, add state-based policy section