- Only allow setting permissions on the root channel - Only allow public channels to be children of public channels