[keycloak-user] Permission logic vs Policy logic