Can you explain how the permission model works?