Updating permissions should occur on the updateConference endpoint, of course