it doesn't but I think we are going to want to tackle other permissions in a single shot as a role or a set of tasks that are run after deploy.  I'll add a backlog item for it.  For example our git checkouts have other-read enabled because we aren't setting a umask and there are some changes (like group permissions) that we will probably need to set as root in main.yml