A better solution would be to have the
user_id in the session, or a
session_id that can be used to lookup the user's permissions (from a database). Storing permissions in the
$_SESSION variable itself would make it difficult to manage the permissions from the admin perspective without explicitly unsetting/resetting the
$_SESSION['permissions'] for the required user's session. Sounds messy..
If it is managed in the database, then the admin can simply change the permissions for the specific user there, and the change will be immediate, and when the user is looked up, it will have the those permissions.