Since vm.annotation.permissions is (soon) no longer going to be used,
don't validate it in validate(), validate model.permissions instead.