Implement object-level permissions for orders