diff --git a/app/models/user.py b/app/models/user.py
index 03cfb7e94..aaaf827c7 100644
--- a/app/models/user.py
+++ b/app/models/user.py
@@ -215,8 +215,7 @@ class User(JSONModel, UserMixin):
             return True
 
         if any(
-            self.has_permission_for_service(service_id, permission)
-            for permission in permissions
+            self.permissions_for_service(service_id) & set(permissions)
         ):
             return True
 
@@ -226,6 +225,9 @@ class User(JSONModel, UserMixin):
             Service.from_id(service_id).organisation_id
         )
 
+    def permissions_for_service(self, service_id):
+        return self._permissions.get(service_id, set())
+
     def has_permission_for_service(self, service_id, permission):
         return permission in self._permissions.get(service_id, [])