the other thing we were noodling on is creating aggregate permissions in the schema that represent a set of permissions required for a given UI