This is to avoid specifying permissions in multiple disjoint places and because most API users shouldn't need these fields.