it would be better if we flattened it and explicitly created each permission?