Permissions are not authentication, they are authorization. AAA Schemes exist (authentication,authorization,auditing) such as TACACS. Perhaps a web version of TACACS+ with modern public key cryptography and back-end agnostic standard would be ideal?