def METHOD_NAME(user, action):
    """ Actions must have permissions, if only one is in the user role then the action is allowed
    """
    if 'permission' not in action:
        logger.error('Action must have "permission" field: %s', str(action))
        return False
    return user.has_perm(action['permission'])