Thank you! I found it. It's also called app_permissions.json (with an s) and not app_permission.json like in the article.