Currently, assigning or updating resource permissions on a client requires one request per resource. We could extend the ACL API to allow an array of resources, allowing a request to assign someone permissions to, say, 10 resources with one request.

We could even add this functionality to the POST /api/clients endpoint, making it possible to create a client and assign permissions to any number of resources in one go.