Only send back permissions user has (skip those with 0)
Protect repositories read/delete via @RequiresPermissions