refactoring permissions into a mixin