I have recent experience from my day job trying to implement permissions on a previously non-permissioned API, and I would like to agree with Ferghis. If you don't think about this up front, the transition will be painful, not to mention impossible to hide completely from users. One point I'd...