Or I can probably use lookup API, I store type of all permission with a resource type , then issue a lookup API for each permission, then merge it.