Always instantiate Permissions object

To follow current logic

src/Api/AdminConsole/Authorization/ClaimsExtensions.cs

@@ -63,7 +63,7 @@ public static class ClaimsExtensions
             AccessSecretsManager = hasClaim(Claims.SecretsManagerAccess),
             Permissions = role == OrganizationUserType.Custom
                 ? GetPermissionsFromClaims(hasClaim)
-                : null
+                : new Permissions()
         };
     }