So about permissions, huh?

There are two standard answers: Access-control lists and Object capabilities. I think the latter approach is better but so far it has not been used in Fediverse