Operational Permission Design