make always permitted parameters configurable