refactor: split permissions_validation.go — separate data loading from validation logic
#21492
+133
−126