This is minor, but I was confused at first, thinking 'entity' referred to `PermissionEntity` and 'no reason to read from DB' meaning not to be read from db at all. I don't know what our convention is for referring to web objects, maybe 'web model'. And possibly simply 'no reason to ever expose activationCode to API'.