I would punt on making a complex permission structure right now. It would be nice to have things encrypted at rest but we can do that later.