code: private Map<String,Function<HttpRequestContext, String>> createSubstitutionMap(String[] permissions, AbstractMethod am) {
          Map<String, Function<HttpRequestContext, String>> map = Maps.newLinkedHashMap();
  
          for (String permission : permissions) {
              Matcher matcher = SUBSTITUTION_MATCHER.matcher(permission);
              while (matcher.find()) {
                  String match = matcher.group();
                  if (map.containsKey(match)) {
                      continue;
                  }
  
                  String param = matcher.group("param");
                  Function<HttpRequestContext, String> substitution;
  
                  if (param.startsWith("?")) {
                      substitution = createQuerySubstitution(param.substring(1));
                  } else {
                      substitution = createPathSubstitution(param, am);
                  }
  
                  map.put(match, substitution);
              }
          }
  
          return map;
      }
docs: Returns a mapping from permissions found in the annotations to functions which can perform any necessary
  substitutions based on actual values in the request.