Adding per-action permissions (Closes #47)