forgot to put embeds_many :permissions in the concern