diff --git a/core/shared/src/main/scala/works/iterative/core/auth/PermissionService.scala b/core/shared/src/main/scala/works/iterative/core/auth/PermissionService.scala
index 37818a8..9c04031 100644
--- a/core/shared/src/main/scala/works/iterative/core/auth/PermissionService.scala
+++ b/core/shared/src/main/scala/works/iterative/core/auth/PermissionService.scala
@@ -11,8 +11,13 @@
 
   extension (op: PermissionOp) def value: String = op
 
+trait Targetable:
+  def permissionTarget: PermissionTarget
+
 opaque type PermissionTarget = String
 object PermissionTarget:
+  given Conversion[Targetable, PermissionTarget] = _.permissionTarget
+
   def apply(target: String): Validated[PermissionTarget] =
     target.split(":", 2) match
       case Array(n, i) => apply(n, i)
@@ -44,6 +49,7 @@
       namespace.trim.nonEmpty && id.trim.nonEmpty,
       "Both namespace and id must be defined"
     )
+    // TODO: escape instead of complaining
     require(
       namespace.indexOf(':') == -1 && id.indexOf(':') == -1,
       "Neither namespace nor id can contain ':'"