Separate upstarts, gatekeeper as root