diff --git a/src/modules/module-metadata/metadata.c b/src/modules/module-metadata/metadata.c
index 16ad0825f..aebe579e7 100644
--- a/src/modules/module-metadata/metadata.c
+++ b/src/modules/module-metadata/metadata.c
@@ -265,6 +265,7 @@ pw_metadata_new(struct pw_context *context, struct pw_resource *resource,
 	impl->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_Metadata,
 			PW_VERSION_METADATA,
+			PW_METADATA_PERM_MASK,
 			properties,
 			global_bind, impl);
 	if (impl->global == NULL) {
diff --git a/src/modules/module-profiler.c b/src/modules/module-profiler.c
index 38f0f2289..0dac145cd 100644
--- a/src/modules/module-profiler.c
+++ b/src/modules/module-profiler.c
@@ -458,6 +458,7 @@ int pipewire__module_init(struct pw_impl_module *module, const char *args)
 	impl->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_Profiler,
 			PW_VERSION_PROFILER,
+			PW_PROFILER_PERM_MASK,
 			pw_properties_copy(props),
 			global_bind, impl);
 	if (impl->global == NULL) {
diff --git a/src/modules/module-session-manager/client-endpoint/endpoint-stream.c b/src/modules/module-session-manager/client-endpoint/endpoint-stream.c
index 40b9bf276..6f66621e5 100644
--- a/src/modules/module-session-manager/client-endpoint/endpoint-stream.c
+++ b/src/modules/module-session-manager/client-endpoint/endpoint-stream.c
@@ -292,6 +292,7 @@ int endpoint_stream_init(struct endpoint_stream *this,
 	this->global = pw_global_new (context,
 			PW_TYPE_INTERFACE_EndpointStream,
 			PW_VERSION_ENDPOINT_STREAM,
+			PW_ENDPOINT_STREAM_PERM_MASK,
 			properties, endpoint_stream_bind, this);
 	if (!this->global)
 		goto no_mem;
diff --git a/src/modules/module-session-manager/client-endpoint/endpoint.c b/src/modules/module-session-manager/client-endpoint/endpoint.c
index 583844a4e..2b12dafa2 100644
--- a/src/modules/module-session-manager/client-endpoint/endpoint.c
+++ b/src/modules/module-session-manager/client-endpoint/endpoint.c
@@ -322,6 +322,7 @@ int endpoint_init(struct endpoint *this,
 	this->global = pw_global_new (context,
 			PW_TYPE_INTERFACE_Endpoint,
 			PW_VERSION_ENDPOINT,
+			PW_ENDPOINT_PERM_MASK,
 			NULL, endpoint_bind, this);
 	if (!this->global)
 		goto no_mem;
diff --git a/src/modules/module-session-manager/client-session/endpoint-link.c b/src/modules/module-session-manager/client-session/endpoint-link.c
index f7f797115..d0c40f0a5 100644
--- a/src/modules/module-session-manager/client-session/endpoint-link.c
+++ b/src/modules/module-session-manager/client-session/endpoint-link.c
@@ -310,6 +310,7 @@ int endpoint_link_init(struct endpoint_link *this,
 	this->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_EndpointLink,
 			PW_VERSION_ENDPOINT_LINK,
+			PW_ENDPOINT_LINK_PERM_MASK,
 			properties, endpoint_link_bind, this);
 	if (!this->global)
 		goto no_mem;
diff --git a/src/modules/module-session-manager/client-session/session.c b/src/modules/module-session-manager/client-session/session.c
index 9c1936874..4ace480d3 100644
--- a/src/modules/module-session-manager/client-session/session.c
+++ b/src/modules/module-session-manager/client-session/session.c
@@ -283,6 +283,7 @@ int session_init(struct session *this,
 	this->global = pw_global_new (context,
 			PW_TYPE_INTERFACE_Session,
 			PW_VERSION_SESSION,
+			PW_SESSION_PERM_MASK,
 			NULL, session_bind, this);
 	if (!this->global)
 		goto no_mem;
diff --git a/src/modules/module-session-manager/endpoint-link.c b/src/modules/module-session-manager/endpoint-link.c
index 86f402d63..5804173b4 100644
--- a/src/modules/module-session-manager/endpoint-link.c
+++ b/src/modules/module-session-manager/endpoint-link.c
@@ -390,6 +390,7 @@ static void *link_new(struct pw_context *context,
 	impl->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_EndpointLink,
 			PW_VERSION_ENDPOINT_LINK,
+			PW_ENDPOINT_LINK_PERM_MASK,
 			properties,
 			global_bind, impl);
 	if (impl->global == NULL) {
diff --git a/src/modules/module-session-manager/endpoint-stream.c b/src/modules/module-session-manager/endpoint-stream.c
index 35c9acfd9..40c048ac1 100644
--- a/src/modules/module-session-manager/endpoint-stream.c
+++ b/src/modules/module-session-manager/endpoint-stream.c
@@ -381,6 +381,7 @@ static void *stream_new(struct pw_context *context,
 	impl->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_EndpointStream,
 			PW_VERSION_ENDPOINT_STREAM,
+			PW_ENDPOINT_STREAM_PERM_MASK,
 			properties,
 			global_bind, impl);
 	if (impl->global == NULL) {
diff --git a/src/modules/module-session-manager/endpoint.c b/src/modules/module-session-manager/endpoint.c
index ed54609ef..a55aad78e 100644
--- a/src/modules/module-session-manager/endpoint.c
+++ b/src/modules/module-session-manager/endpoint.c
@@ -390,6 +390,7 @@ static void *endpoint_new(struct pw_context *context,
 	impl->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_Endpoint,
 			PW_VERSION_ENDPOINT,
+			PW_ENDPOINT_PERM_MASK,
 			properties,
 			global_bind, impl);
 	if (impl->global == NULL) {
diff --git a/src/modules/module-session-manager/session.c b/src/modules/module-session-manager/session.c
index ebe6871f1..84d33bfef 100644
--- a/src/modules/module-session-manager/session.c
+++ b/src/modules/module-session-manager/session.c
@@ -379,6 +379,7 @@ static void *session_new(struct pw_context *context,
 	impl->global = pw_global_new(context,
 			PW_TYPE_INTERFACE_Session,
 			PW_VERSION_SESSION,
+			PW_SESSION_PERM_MASK,
 			properties,
 			global_bind, impl);
 	if (impl->global == NULL) {
diff --git a/src/pipewire/client.h b/src/pipewire/client.h
index 9acc5b3f7..eb97465cd 100644
--- a/src/pipewire/client.h
+++ b/src/pipewire/client.h
@@ -25,6 +25,8 @@ extern "C" {
  */
 #define PW_TYPE_INTERFACE_Client	PW_TYPE_INFO_INTERFACE_BASE "Client"
 
+#define PW_CLIENT_PERM_MASK		PW_PERM_RWX
+
 #define PW_VERSION_CLIENT		3
 struct pw_client;
 
diff --git a/src/pipewire/core.h b/src/pipewire/core.h
index 757270824..d2ad0c238 100644
--- a/src/pipewire/core.h
+++ b/src/pipewire/core.h
@@ -34,6 +34,8 @@ extern "C" {
 #define PW_TYPE_INTERFACE_Core		PW_TYPE_INFO_INTERFACE_BASE "Core"
 #define PW_TYPE_INTERFACE_Registry	PW_TYPE_INFO_INTERFACE_BASE "Registry"
 
+#define PW_CORE_PERM_MASK		PW_PERM_R|PW_PERM_X|PW_PERM_M
+
 #define PW_VERSION_CORE		4
 struct pw_core;
 #define PW_VERSION_REGISTRY	3
diff --git a/src/pipewire/device.h b/src/pipewire/device.h
index a81e4257d..47a27d7ac 100644
--- a/src/pipewire/device.h
+++ b/src/pipewire/device.h
@@ -25,6 +25,8 @@ extern "C" {
 
 #define PW_TYPE_INTERFACE_Device	PW_TYPE_INFO_INTERFACE_BASE "Device"
 
+#define PW_DEVICE_PERM_MASK		PW_PERM_RWX
+
 #define PW_VERSION_DEVICE		3
 struct pw_device;
 
diff --git a/src/pipewire/extensions/metadata.h b/src/pipewire/extensions/metadata.h
index f448eb1b2..3fa90dc66 100644
--- a/src/pipewire/extensions/metadata.h
+++ b/src/pipewire/extensions/metadata.h
@@ -21,6 +21,8 @@ extern "C" {
  */
 #define PW_TYPE_INTERFACE_Metadata		PW_TYPE_INFO_INTERFACE_BASE "Metadata"
 
+#define PW_METADATA_PERM_MASK			PW_PERM_RWX
+
 #define PW_VERSION_METADATA			3
 struct pw_metadata;
 
diff --git a/src/pipewire/extensions/profiler.h b/src/pipewire/extensions/profiler.h
index abd94fd6b..711124c59 100644
--- a/src/pipewire/extensions/profiler.h
+++ b/src/pipewire/extensions/profiler.h
@@ -26,6 +26,8 @@ struct pw_profiler;
 
 #define PW_EXTENSION_MODULE_PROFILER		PIPEWIRE_MODULE_PREFIX "module-profiler"
 
+#define PW_PROFILER_PERM_MASK	PW_PERM_R
+
 #define PW_PROFILER_EVENT_PROFILE		0
 #define PW_PROFILER_EVENT_NUM			1
 
diff --git a/src/pipewire/extensions/session-manager/interfaces.h b/src/pipewire/extensions/session-manager/interfaces.h
index a05870784..c24d361db 100644
--- a/src/pipewire/extensions/session-manager/interfaces.h
+++ b/src/pipewire/extensions/session-manager/interfaces.h
@@ -21,18 +21,22 @@ extern "C" {
  */
 
 #define PW_TYPE_INTERFACE_Session		PW_TYPE_INFO_INTERFACE_BASE "Session"
+#define PW_SESSION_PERM_MASK			PW_PERM_RWX
 #define PW_VERSION_SESSION			0
 struct pw_session;
 
 #define PW_TYPE_INTERFACE_Endpoint		PW_TYPE_INFO_INTERFACE_BASE "Endpoint"
+#define PW_ENDPOINT_PERM_MASK			PW_PERM_RWX
 #define PW_VERSION_ENDPOINT			0
 struct pw_endpoint;
 
 #define PW_TYPE_INTERFACE_EndpointStream	PW_TYPE_INFO_INTERFACE_BASE "EndpointStream"
+#define PW_ENDPOINT_STREAM_PERM_MASK		PW_PERM_RWX
 #define PW_VERSION_ENDPOINT_STREAM		0
 struct pw_endpoint_stream;
 
 #define PW_TYPE_INTERFACE_EndpointLink		PW_TYPE_INFO_INTERFACE_BASE "EndpointLink"
+#define PW_ENDPOINT_LINK_PERM_MASK		PW_PERM_RWX
 #define PW_VERSION_ENDPOINT_LINK		0
 struct pw_endpoint_link;
 
diff --git a/src/pipewire/factory.h b/src/pipewire/factory.h
index 7be4f9c27..26af2a06e 100644
--- a/src/pipewire/factory.h
+++ b/src/pipewire/factory.h
@@ -27,6 +27,8 @@ extern "C" {
  */
 #define PW_TYPE_INTERFACE_Factory	PW_TYPE_INFO_INTERFACE_BASE "Factory"
 
+#define PW_FACTORY_PERM_MASK		PW_PERM_R
+
 #define PW_VERSION_FACTORY		3
 struct pw_factory;
 
diff --git a/src/pipewire/global.c b/src/pipewire/global.c
index 3102f8c8d..9aff3210c 100644
--- a/src/pipewire/global.c
+++ b/src/pipewire/global.c
@@ -25,10 +25,10 @@ struct impl {
 SPA_EXPORT
 uint32_t pw_global_get_permissions(struct pw_global *global, struct pw_impl_client *client)
 {
-	if (client->permission_func == NULL)
-		return PW_PERM_ALL;
-
-	return client->permission_func(global, client, client->permission_data);
+	uint32_t permissions = global->permission_mask;
+	if (client->permission_func != NULL)
+		permissions &= client->permission_func(global, client, client->permission_data);
+	return permissions;
 }
 
 /** Create a new global
@@ -47,6 +47,7 @@ struct pw_global *
 pw_global_new(struct pw_context *context,
 	      const char *type,
 	      uint32_t version,
+	      uint32_t permission_mask,
 	      struct pw_properties *properties,
 	      pw_global_bind_func_t func,
 	      void *object)
@@ -71,6 +72,7 @@ pw_global_new(struct pw_context *context,
 	this->context = context;
 	this->type = type;
 	this->version = version;
+	this->permission_mask = permission_mask;
 	this->func = func;
 	this->object = object;
 	this->properties = properties;
diff --git a/src/pipewire/global.h b/src/pipewire/global.h
index 2036dfba4..a60e650f9 100644
--- a/src/pipewire/global.h
+++ b/src/pipewire/global.h
@@ -65,6 +65,7 @@ struct pw_global *
 pw_global_new(struct pw_context *context,	/**< the context */
 	      const char *type,			/**< the interface type of the global */
 	      uint32_t version,			/**< the interface version of the global */
+	      uint32_t permission_mask,		/**< mask of valid permissions */
 	      struct pw_properties *properties,	/**< extra properties */
 	      pw_global_bind_func_t func,	/**< function to bind */
 	      void *object			/**< global object */);
diff --git a/src/pipewire/impl-client.c b/src/pipewire/impl-client.c
index d7d46ca0d..14d903cab 100644
--- a/src/pipewire/impl-client.c
+++ b/src/pipewire/impl-client.c
@@ -514,6 +514,7 @@ int pw_impl_client_register(struct pw_impl_client *client,
 	client->global = pw_global_new(context,
 				       PW_TYPE_INTERFACE_Client,
 				       PW_VERSION_CLIENT,
+				       PW_CLIENT_PERM_MASK,
 				       properties,
 				       global_bind,
 				       client);
diff --git a/src/pipewire/impl-core.c b/src/pipewire/impl-core.c
index e10a5fe19..f43314c31 100644
--- a/src/pipewire/impl-core.c
+++ b/src/pipewire/impl-core.c
@@ -588,6 +588,7 @@ int pw_impl_core_register(struct pw_impl_core *core,
         core->global = pw_global_new(context,
 					PW_TYPE_INTERFACE_Core,
 					PW_VERSION_CORE,
+					PW_CORE_PERM_MASK,
 					properties,
 					global_bind,
 					core);
diff --git a/src/pipewire/impl-device.c b/src/pipewire/impl-device.c
index 55f88988d..bf9e9aac6 100644
--- a/src/pipewire/impl-device.c
+++ b/src/pipewire/impl-device.c
@@ -560,6 +560,7 @@ int pw_impl_device_register(struct pw_impl_device *device,
         device->global = pw_global_new(context,
 				       PW_TYPE_INTERFACE_Device,
 				       PW_VERSION_DEVICE,
+				       PW_DEVICE_PERM_MASK,
 				       properties,
 				       global_bind,
 				       device);
diff --git a/src/pipewire/impl-factory.c b/src/pipewire/impl-factory.c
index 5025e9c60..82ad79d8c 100644
--- a/src/pipewire/impl-factory.c
+++ b/src/pipewire/impl-factory.c
@@ -174,6 +174,7 @@ int pw_impl_factory_register(struct pw_impl_factory *factory,
         factory->global = pw_global_new(context,
 					PW_TYPE_INTERFACE_Factory,
 					PW_VERSION_FACTORY,
+					PW_FACTORY_PERM_MASK,
 					properties,
 					global_bind,
 					factory);
diff --git a/src/pipewire/impl-link.c b/src/pipewire/impl-link.c
index 15d700d87..42f94f180 100644
--- a/src/pipewire/impl-link.c
+++ b/src/pipewire/impl-link.c
@@ -1462,6 +1462,7 @@ int pw_impl_link_register(struct pw_impl_link *link,
 	link->global = pw_global_new(context,
 				     PW_TYPE_INTERFACE_Link,
 				     PW_VERSION_LINK,
+				     PW_LINK_PERM_MASK,
 				     properties,
 				     global_bind,
 				     link);
diff --git a/src/pipewire/impl-metadata.c b/src/pipewire/impl-metadata.c
index c14d49aa2..49d0e6c04 100644
--- a/src/pipewire/impl-metadata.c
+++ b/src/pipewire/impl-metadata.c
@@ -519,6 +519,7 @@ int pw_impl_metadata_register(struct pw_impl_metadata *metadata,
         metadata->global = pw_global_new(context,
 					PW_TYPE_INTERFACE_Metadata,
 					PW_VERSION_METADATA,
+					PW_METADATA_PERM_MASK,
 					properties,
 					global_bind,
 					metadata);
diff --git a/src/pipewire/impl-module.c b/src/pipewire/impl-module.c
index 982cf520c..23df06cca 100644
--- a/src/pipewire/impl-module.c
+++ b/src/pipewire/impl-module.c
@@ -222,6 +222,7 @@ pw_context_load_module(struct pw_context *context,
 	this->global = pw_global_new(context,
 				     PW_TYPE_INTERFACE_Module,
 				     PW_VERSION_MODULE,
+				     PW_MODULE_PERM_MASK,
 				     NULL,
 				     global_bind,
 				     this);
diff --git a/src/pipewire/impl-node.c b/src/pipewire/impl-node.c
index 87d860cb0..97832b1a3 100644
--- a/src/pipewire/impl-node.c
+++ b/src/pipewire/impl-node.c
@@ -773,6 +773,7 @@ int pw_impl_node_register(struct pw_impl_node *this,
 	this->global = pw_global_new(context,
 				     PW_TYPE_INTERFACE_Node,
 				     PW_VERSION_NODE,
+				     PW_NODE_PERM_MASK,
 				     properties,
 				     global_bind,
 				     this);
diff --git a/src/pipewire/impl-port.c b/src/pipewire/impl-port.c
index 3f02379b1..2df4a7408 100644
--- a/src/pipewire/impl-port.c
+++ b/src/pipewire/impl-port.c
@@ -1000,6 +1000,7 @@ int pw_impl_port_register(struct pw_impl_port *port,
 	port->global = pw_global_new(node->context,
 				PW_TYPE_INTERFACE_Port,
 				PW_VERSION_PORT,
+				PW_PORT_PERM_MASK,
 				properties,
 				global_bind,
 				port);
diff --git a/src/pipewire/link.h b/src/pipewire/link.h
index a51bba793..26b929436 100644
--- a/src/pipewire/link.h
+++ b/src/pipewire/link.h
@@ -31,6 +31,8 @@ extern "C" {
 
 #define PW_TYPE_INTERFACE_Link	PW_TYPE_INFO_INTERFACE_BASE "Link"
 
+#define PW_LINK_PERM_MASK	PW_PERM_R
+
 #define PW_VERSION_LINK		3
 struct pw_link;
 
diff --git a/src/pipewire/module.h b/src/pipewire/module.h
index 4ed5ef13d..6be7b9938 100644
--- a/src/pipewire/module.h
+++ b/src/pipewire/module.h
@@ -24,6 +24,8 @@ extern "C" {
  */
 #define PW_TYPE_INTERFACE_Module	PW_TYPE_INFO_INTERFACE_BASE "Module"
 
+#define PW_MODULE_PERM_MASK		PW_PERM_R
+
 #define PW_VERSION_MODULE		3
 struct pw_module;
 
diff --git a/src/pipewire/node.h b/src/pipewire/node.h
index 198fbb4f4..f95db120e 100644
--- a/src/pipewire/node.h
+++ b/src/pipewire/node.h
@@ -29,6 +29,8 @@ extern "C" {
  */
 #define PW_TYPE_INTERFACE_Node	PW_TYPE_INFO_INTERFACE_BASE "Node"
 
+#define PW_NODE_PERM_MASK	PW_PERM_RWXM
+
 #define PW_VERSION_NODE		3
 struct pw_node;
 
diff --git a/src/pipewire/permission.h b/src/pipewire/permission.h
index 672cdbb71..471ea6210 100644
--- a/src/pipewire/permission.h
+++ b/src/pipewire/permission.h
@@ -30,7 +30,8 @@ extern "C" {
 				  *  present in order to call methods that modify the object. */
 #define PW_PERM_M	0010	/**< metadata can be set on object, Since 0.3.9 */
 
-#define PW_PERM_RWX	(PW_PERM_R|PW_PERM_W|PW_PERM_X)
+#define PW_PERM_RW	(PW_PERM_R|PW_PERM_W)
+#define PW_PERM_RWX	(PW_PERM_RW|PW_PERM_X)
 #define PW_PERM_RWXM	(PW_PERM_RWX|PW_PERM_M)
 
 #define PW_PERM_IS_R(p) (((p)&PW_PERM_R) == PW_PERM_R)
diff --git a/src/pipewire/port.h b/src/pipewire/port.h
index 298731a02..8c973a06f 100644
--- a/src/pipewire/port.h
+++ b/src/pipewire/port.h
@@ -29,6 +29,8 @@ extern "C" {
 
 #define PW_TYPE_INTERFACE_Port	PW_TYPE_INFO_INTERFACE_BASE "Port"
 
+#define PW_PORT_PERM_MASK	PW_PERM_R|PW_PERM_X|PW_PERM_M
+
 #define PW_VERSION_PORT		3
 struct pw_port;
 
diff --git a/src/pipewire/private.h b/src/pipewire/private.h
index 7b0c584a3..90993ba16 100644
--- a/src/pipewire/private.h
+++ b/src/pipewire/private.h
@@ -288,6 +288,7 @@ struct pw_global {
 
 	const char *type;		/**< type of interface */
 	uint32_t version;		/**< version of interface */
+	uint32_t permission_mask;	/**< possible permissions */
 
 	pw_global_bind_func_t func;	/**< bind function */
 	void *object;			/**< object associated with the interface */