store the permissions in an object in the collection

That way we can have multiple permissions for each user/instance
relationship