> Does this mean that when an alert is created I need to create two sets of permissions: One with the company and another one with the user? Yes this is likely how you will want to model it