Payload for PUT .../permissions/{user_id} — creates or updates one user's exception.

The target user comes from the path, not the body — unlike datasets' equivalent schema, there's no bare PUT .../permissions route here for a body-only user_id to serve.