I might also move sending of the email to another method on `CreatePermissionProcess`, something like `notifyRecipient` (and call from within the resource endpoint), since `savePermission` doesn't convey the notion of sending email.