Restructured has_permissions to the fail-fast approach you outlined below -- much simpler.