How to add and manage permissions to the guarantee service?