Looks like it is working. The only example of it failing that I can see is in a signature, which is a separate permission setting.