Locking down perms in config.xml