we also have issues for reflection based APIs, to eventually make it so you can read the list of permissions from the schema directly too