building a permission system from scratch at cal.com