CDB-3103 Permission checking logic and started to plug into API endpoints