Why is this needed at all? I thought we used `secure_permissions` to handle permissions. It should be possible to set permissions for all roles except perhaps for the admin role.