i will say that it's really hard to completely abstract over permission logic