TODO comments: handleStringOrObjectDefinition()
better key in object passed to permissionCheck functions