Core pr 6

New permission and some logic rewrite based on review from PR5.
Outside the scope of this review but we should not need to programmatically submit forms to achieve this.