Function set_permission_expr 

pub fn set_permission_expr(
    conn: &Connection,
    subject_kind: &str,
    subject_id: &str,
    permission: &str,
    expression: &str,
) -> Result<(), String>

Stores an expression, or clears it when expression is empty/blank.

Validates by parsing first: an unparseable expression denies everything at evaluation time, so letting one be saved would silently lock a user out.