treat permissions as a set

fixes duplicated content in workspace