First cut at client-side permissions enforcement.