Read from a comment that i can't find back.
I have an option to use permission nodes instead of config file. This will require to replace the PermissionChecker on demand.
Permission nodes should look like this :
<baseperm>.<module>.id[.metadata.metadata]