Whitelisting a certain permission groups seems like quite a convenient option, I should investigate into that.