Store model permissions as constants rather than methods