you could do so at generation time, but the general recommendation for safety is to do so at runtime if it is a hard permissions requirement