permissions: prevent duplicate items from overlapping permissions, fix misuse of hasattr