add explicit "defer" to extra permission for system fields