Eng 6857

This could be the place to switch to a bit set. It's all private and well encapsulated. Maybe even create a Permissions class that wraps a bit set inside and reuse it in other places as well, e.g. `AuthUser`. This could also be done in subsequent tickets.