refactor(api): migrate own/all permissions and rewire enforcement