Sandbox users automatically get permissions turned on