[HEAD](bug #3318) Granular renew permissions