so if a new permission is added, it should be explicitly referenced by the frontend, not implicitly listed by the backend