At present, we have no system by which permissions can be added to the permissions.json file and safely migrated.

We need to design a system which allows permissions to be added, so that we can add new permissions for the configuration API, apps API, and any other endpoints which we need to create.

It is expected that if we create a situation where a permission needs to be changed or removed, that the migration system would have to be updated to manage those cases.

At present, permissions migrations are triggered as a part of the migration system, which requires that the database version be bumped. Whether or not this should be required in future is up for discussion.

If we continue to use the version bumping to trigger a migration, then we need to protect the schema.js, fixtures.json and permissions.json files from being updated without a version bump in some way - possibly via a simple test which checks the content.