Fix #35: Validate permissions by app type