I think hardcoding the "AllowedActions" permission model is too specific to be useful to a wide variety of folks..  that's why I suggested making a generic list of strings. (e.g. called Permissions, which could be anything the app wants)