I was mistaken; I was conflating Permissive Security with SIP. Permissive Security does have those limitations.