We built a custom permissions DSL at Figma