there isn't really a concept of having a permission that's divorced from a resource