Having an "enabled" attribute makes the configuration explicit both from the XML side and from the code that needs to return SecureCaches. Making it implicit in the permissions/roles would not make it evident from the configuration (and from the code) whether authorization should be enabled. So you'd save an attribute, but you gain in opacity. And you don't really want that in security :)