Policy permissions must be mutable