Merchants should be able to select permissions for new users added to their portal (e.g. a user that can view but not modify invoices)