Fleshed out permissions management

Still need to enforce permissions