and it will only return HAS_PERMISSION if the user can create the appointment on the org and for the city