Background :- while writing karate tests for mod-patron we encountered below issue. In Karate a new tenant & user will be created for each run with given permissions in order to make tests independent .   
Karate tests steps:-
1:- create new tenant & user

2:-assign required permission*(patron.hold.item.post)*

*3:-send a post request to /patron/account/{accountId}/item/{itemId}/hold*

**Overview:- when a new user is  hitting /patron/account/{accountId}/item/{itemId}/hold api with permissionsRequired permissions , request is getting timeout error, but it is working when we add modperms.circulation.requests.item.post([https://github.com/folio-org/mod-circulation/blob/master/descriptors/ModuleDescriptor-template.json#:~:text=%22modulePermi[…]uests.item.post%22,%5D|https://github.com/folio-org/mod-circulation/blob/master/descriptors/ModuleDescriptor-template.json#:~:text=%22modulePermissions%22%3A%20%5B,%22modperms.circulation.requests.item.post%22,-%5D].) permission to the user.
Ideally modulePermissions should be  granted to the token generated when a request is made to that endpoint automatically.

>>Result with only required permission (patron.hold.item.post)

1 > POST https://folio-snapshot-okapi.dev.folio.org:443/patron/account/ab075d2a-8c0a-4a40-9e7c-79b0c80fa684/item/0e0b3b57-839a-457a-a3e0-3060e88cb7ed/hold
1 > Content-Type: application/json; charset=UTF-8
1 > x-okapi-token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0LXVzZXIiLCJ1c2VyX2lkIjoiMDAwMDAwMDAtMTExMS01NTU1LTk5OTktOTk5OTk5OTk5OTkyIiwiaWF0IjoxNjM5NTc4OTU2LCJ0ZW5hbnQiOiJ0ZXN0ZW5hbnQyNDYzNDM0MjM2NDA1MDUzNDQwIn0.mPFW8n1FXhSsm9jDdouK3_9Tskes9pZ4UMNSgBEOeFU
1 > Accept: application/json, text/plain
1 > Content-Length: 105
1 > Host: folio-snapshot-okapi.dev.folio.org:443
1 > Connection: Keep-Alive
1 > User-Agent: Apache-HttpClient/4.5.13 (Java/11.0.12)
1 > Accept-Encoding: gzip,deflate

{ "pickupLocationId": "949f12df-9b16-4ebf-8e46-447f3dd8a79e", "requestDate": "2021-12-15T03:24:12.963+00:00" }

20:06:49.100 java.net.SocketTimeoutException: Read timed out, http call failed after 30920 milliseconds for url: https://folio-snapshot-okapi.dev.folio.org:443/patron/account/ab075d2a-8c0a-4a40-9e7c-79b0c80fa684/item/0e0b3b57-839a-457a-a3e0-3060e88cb7ed/hold
20:06:49.101 classpath:domain/edge-patron/features/patrons.feature:125
When method POST
*http call failed after 30920 milliseconds for url: https://folio-snapshot-okapi.dev.folio.org:443/patron/account/ab075d2a-8c0a-4a40-9e7c-79b0c80fa684/item/0e0b3b57-839a-457a-a3e0-3060e88cb7ed/hold*
classpath:domain/edge-patron/features/patrons.feature:125

**

>>Result with  required permission & modulePermission (patron.hold.item.post,

modperms.circulation.requests.item.post)

1 > POST https://folio-snapshot-okapi.dev.folio.org:443/patron/account/461e02d3-1480-4879-96eb-b6ddf2c22e5a/item/08d4c88d-c5f1-485f-be92-b7860cd73a85/hold
1 > Content-Type: application/json; charset=UTF-8
1 > x-okapi-token: eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiJ0ZXN0LXVzZXIiLCJ1c2VyX2lkIjoiMDAwMDAwMDAtMTExMS01NTU1LTk5OTktOTk5OTk5OTk5OTkyIiwiaWF0IjoxNjM5NTc5MjgzLCJ0ZW5hbnQiOiJ0ZXN0ZW5hbnQ3NTAxMDA1NjMxODUyMzgyMjA4In0.vjsHvpV88Jatl9KXzFiJqsfOQjtFRI2cvJL_mIAvIcg
1 > Accept: application/json, text/plain
1 > Content-Length: 105
1 > Host: folio-snapshot-okapi.dev.folio.org:443
1 > Connection: Keep-Alive
1 > User-Agent: Apache-HttpClient/4.5.13 (Java/11.0.12)
1 > Accept-Encoding: gzip,deflate

{ "pickupLocationId": "6f471f44-121b-4ac8-a7cf-7c2cb2865162", "requestDate": "2021-12-15T03:24:12.963+00:00" }

20:11:47.582 response time in milliseconds: 1325
1 < 201
1 < Date: Wed, 15 Dec 2021 14:41:48 GMT
1 < Content-Type: application/json
1 < Transfer-Encoding: chunked
1 < Connection: keep-alive
1 < vary: origin
{
"item":

{ "itemId": "08d4c88d-c5f1-485f-be92-b7860cd73a85", "instanceId": "7c7d0a81-8157-4270-ab95-1833c4be79bd", "title": "TestInstance" }

,
"pickupLocationId": "6f471f44-121b-4ac8-a7cf-7c2cb2865162",
"queuePosition": 1,
"requestId": "082be19f-65f2-4c88-bf28-7f9645f81c91",
"requestDate": "2021-12-15T03:24:12.963+00:00",
"status": "Open - Not yet filled"
}

Interested parties: @Marc Johnson