tightened required config permissions: #MSG-41 fixed