Output clean permissions object on the controller instance + user controller filters out correctly