API/ticket: rework coarse grained permission computation