通过会话限制对管理页面的访问

I've been stuck trying to block access to an admin page using PHP. The PHP is below but I can't figure out which combination of statement I need to use for the permission to be selected.

When I dump my session it's always null but the email session is there. It's a simple login requiring email and password. I basically want it to also get their permission from the DB.

<?php
session_start();
include ('../config/config.php');

 /* basic field validation */
$email = trim($_POST["email"]);
$password = trim ($_POST["password"]);

/* check if details are empty, redirect if they are */
if (empty($email) or empty($password)) {
    $_SESSION["message"] = "You must enter your email and password";
    //Redirect to index
    header("Location: ../index.php");
    exit;
}
/* sanitise the input */
$email = strip_tags($email);
$password = strip_tags($password);

 /* SQL user selection query, with error handling for the SQL */
$query = "SELECT email, permission FROM users WHERE email = '$email' AND password = '$password'";
$result = mysqli_query($mysqli,$query) or exit("Error in query: $query. " . mysqli_error());

/* on query success, set sessions for email and userid */
if ($row = mysqli_fetch_assoc($result)) {
    $_SESSION["authemail"] = $email;
    $_SESSION["permission"] = $permission;
    /* redirect the user to the secured page */
    header("Location: ../loggedin.php");
    } else {
    /* display error if login was not successful and redirect to index */
    $_SESSION["message"] = "Could not log in as $email - $query";
    header("index.php");
    }
    ?>

Feel free to edit some of the text out if it isn't relavent.