Fixes #7893 - Restrict routes and create permissions