Sanitization rather than validation in permission system