Depending on how you are using permissions, you are not required to provide a permission handler.

PicketLink provides some built-in implementations for class, string and entities based permissions. If none of these are enough, you can always provide your own.