add permission model and baseline test for polymorphic assoc