why `assert false` since `null` is a valid return type ?  (and the it is checked for in the `hasPermission` methods)