Pluggable PermissionsEvaluationService; ApplicationUsers#filterPermissions.