Where are permissions stored in DB?
Permissions are stored in the permission table. 

The table stores a comma-separated list of permissions that are enabled for each role, by role ID, which links back to the role table.

The users_roles table makes the final link between users and the roles assigned to them.