Tightening up permissions in dashboard