Replace magic STALE plugin permission with an explicit list