core: fix permission evaluation to use rule-based matching instead of wildcard patterns