Permission:
    | "tenant:read"
    | "tenant:write"
    | "policy:read"
    | "policy:draft"
    | "policy:approve"
    | "policy:publish"
    | "device:read"
    | "device:enroll"
    | "device:revoke"
    | "receipt:read"
    | "event:read"
    | "flag:write"