Api entities permissions architecture

I'm using Symfony for a large web app and i'm starting to wonder about the architecture of the entities and permissions related to.

I have a lot of permissions methods related to entities that are organized like that :

Entities\User\User extends Entities\User\UserPermissions

I'm aware that entities should only reflect what's in the database but doing that allows me to produce fast and very comprehensible code :

$user = new User();
$file = new File();

if ($file->canUserSend($user))
{
   $this->send($file)
}

And i know that common architectures proceed more or less this way :

$user = new User();
$file = new File();
use Authority;

if (Authority::can('userSendFile', [ 'user' => $user, 'file' => $file ]))
{
   $this->send($file)
}

So i'm asking for your opinion, and experience on that ?

What is the right architecture ? And if it's the second, is right architecture should prevails on coding fluidity ?