implement persistence of permission based on mybatis