Checking for user permissions
I would say you do too many things at once. The important thing here is this check:

if (userManager.IsInRole(currentUserId, thisRole.Name))
{
    return true;
}


This needs a list of role-names to iterate over:

foreach (var roleName in roleNames)
{
    if (userManager.IsInRole(userId, roleName))
    {
        return true;
    }
}

return false;


The list of role-names seems to be dependent of some given permissions and a company:

var givenPermissions = GetGivenPermissions();
var roleNames = GetRoleNames(companyId, givenPermissions);


The first is easy enough to extract from the given code:

IEnumerable&lt;string&gt; GetGivenPermissions()
{
    return Permissions.Split(',').ToArray();
}


The other one is trickier, but I think I got it right:

IEnumerable&lt;string&gt; GetRoleNames(string companyId, IEnumerable&lt;string&gt; givenPermissions)
{
    var existingPermissions = db.Permissions.Select(p =&gt; p.ActionName);
    var relevantPermissions = givenPermissions.Intersect(existingPermissions);

    foreach (var permission in relevantPermissions)
    {
        var allRoles = db.Roles.Select(x =&gt; x.Id);
        var relevantPermissionRoles = db.PermissionRoles
                                        .Where(p =&gt; p.Permission.ActionName == permission &amp;&amp; p.CompanyId == companyId)
                                        .Select(x =&gt; x.RoleId)
                                        .ToList();

        var relevantRoles = allRoles.Intersect(relevantPermissionRoles).ToList();

        foreach (var role in relevantRoles)
        {
            var thisRole = db.Roles.Find(role);
            var name = thisRole.Name;
            yield return name;
        }
    }
}


This is one nasty query: 


It's a good mix of things querying the database and things filtered in memory. - It's hard to figure out what it actually do, and what the requirements for the roles really are. 
It's also a mix of code operating on objects and primitive values, which is probably why db.Roles is queried twice.


What I would like to see in here is something that:


First retrieve necessary data from the database, once.
Filter it against in-memory data.
Return the resulting role names.