Basic work

I thought of this permission object as mapping to objects, not users (but for the User object it's of course one and the same.  Thus work.id here.