Not sure whether the default should be "allow pull, restrict push" or "restrict push and pull".