Revoke permissions for restrictions (concept)

Refs #970