Add support for 'permission' field for database APIs and model

Implements CLT-383