First cut of permissions task endpoint