There are various nodes in namespace zero for which the specification requires limited access for authorized users, such as users who have the SecurityAdmin role and/or access only through encrypted connections. Examples for such nodes are the various nodes for certificate management below the ServerConfiguration object, the role objects below the RoleSet object and the SessionSecurityDiagnosticsArray. Furthermore the RolePermissions attribute itself "shall only be readable by administrators".

With RolePermissions and AccessRestrictions there are now ways to express these limitations in the NodeSet, but the UANodeSet (implicitly) assigns the namespace DefaultRolePermissions (which are not given either) to every node, thus contradicting the written part of the specification.

The SessionSecurityDiagnostics objects must be created by the server, so it is not possible to have RolePermissions for the objects in the NodeSet. However the suitable RolePermissions could be set at the type, so when instancing the object in the server, the correct RolePermissions could be copied from the type.