[AdminService] - hasPermission fails to validate models that are hidden (e.g. Attachment)