AccessPermission.user_id is VARCHAR (stores username), not UUID. Changed to compare with user.username instead of user.id.