read permissions on every GET

plugins/employees/plugin.py

@@ -51,6 +51,18 @@ class EmployeesPlugin(BasePlugin):
             api_prefix=self._manifest.get('api_prefix', '/api/employees'),
         )
 
+    def get_permissions(self) -> List:
+        """Reading the staff directory.
+
+        The directory is names, SSOs, photographs and who reports to whom. It
+        was reachable with no account at all, which is how a permissions
+        question ends up answered by nobody. One read permission: the write
+        side of this plugin is an import, run from the CLI.
+        """
+        return [
+            ('employees.view', 'View the employee directory', 'employees'),
+        ]
+
     def get_blueprint(self) -> Optional[Blueprint]:
         """Return Flask Blueprint with API routes."""
         return employees_bp