How to define User/Permission relationship as M:M?
Just an idea - should there be a terenary relationship in there?  There seems to be a three way relationship between the resource, permission and the user.