added PermissionResource to support a call-dont-ask like validation process
moved constants to an interface to support real inheritence when needed