One of HasuraDB's engineers here. Permissions are declaratively configured. You can look at the source for the demo here :

https://github.com/hasura/demo1-config/tree/master/hasura-db

*_permissions.yml are used to configure permissions.