I set up the permissions to a URL in the Zuul Gateway microservice because I access the endpoints through the gateway, so I believe there is where I should put the rules.