Can add or remove permissions, but need secure checks