- Don't grant `full_access` when setting specific permissions - All rooms need to be set to protected - No rooms should have the prebooking-required flag (since only the ACL is used anyway)