Reorganize permissions code, implement basic-common-permissions group