tighten governor permissions