WL-3229 Limit what permissions can be changed.

This defines:
- frozen permissions (can't be changed).
- add only permissions (can only be granted).