diff --git a/admin_permissions.go b/admin_permissions.go
index 8ebbe76..221084a 100644
--- a/admin_permissions.go
+++ b/admin_permissions.go
@@ -1,23 +1,20 @@
 package user
 
-import (
-	"git.golem15.com/golem15/sm-user-plugin/classes"
-	"git.golem15.com/golem15/sm-user-plugin/controllers"
-	"git.golem15.com/golem15/summercms/modules/pact"
-)
+import "git.golem15.com/golem15/summercms/modules/pact"
 
 const userPermissionTab = "golem15.user::lang.plugin.tab"
 
 // Permissions is the plugin's Winter registerPermissions() catalog plus one
 // code of its own. The four PHP codes default to the developer role;
 // impersonate_user is registered so imported backend roles that name it stay
-// valid, although no screen uses it. manage_privileged_groups has no default
-// role: only a superuser, or a role that was granted it explicitly, may
-// change the email or password of a privileged-group member or delete one.
+// valid, although no screen uses it. The fifth code
+// (classes.PermissionManagePrivilegedGroups) has no default role: only a
+// superuser, or a role that was granted it explicitly, may change the email
+// or password of a privileged-group member or delete one.
 func (*Plugin) Permissions() []pact.Permission {
 	return []pact.Permission{
 		{
-			Code:  controllers.PermissionAccessUsers,
+			Code:  "golem15.users.access_users",
 			Tab:   userPermissionTab,
 			Label: "golem15.user::lang.plugin.access_users",
 			Roles: []string{"developer"},
@@ -41,7 +38,7 @@ func (*Plugin) Permissions() []pact.Permission {
 			Roles: []string{"developer"},
 		},
 		{
-			Code:  classes.PermissionManagePrivilegedGroups,
+			Code:  "golem15.users.manage_privileged_groups",
 			Tab:   userPermissionTab,
 			Label: "golem15.user::lang.plugin.manage_privileged_groups",
 		},
diff --git a/admin_users_test.go b/admin_users_test.go
index 199dedb..9f6928b 100644
--- a/admin_users_test.go
+++ b/admin_users_test.go
@@ -7,6 +7,7 @@ import (
 	"strings"
 	"testing"
 
+	"git.golem15.com/golem15/sm-user-plugin/classes"
 	"git.golem15.com/golem15/sm-user-plugin/models"
 	"git.golem15.com/golem15/summercms/modules/compass"
 )
@@ -20,6 +21,27 @@ const (
 // permission gating, the list schema, row states, search, the three filters
 // and an update.
 func TestAdminUsersTracer(t *testing.T) {
+	// The permission catalog: the four Winter codes default to the developer
+	// role, the privileged-groups code to no role at all.
+	var codes []string
+	for _, permission := range (&Plugin{}).Permissions() {
+		role := "-"
+		if len(permission.Roles) == 1 {
+			role = permission.Roles[0]
+		}
+		codes = append(codes, permission.Code+"@"+role)
+		if permission.Tab != "golem15.user::lang.plugin.tab" || !strings.HasPrefix(permission.Label, "golem15.user::lang.plugin.") {
+			t.Fatalf("permission %+v", permission)
+		}
+	}
+	if want := []string{
+		"golem15.users.access_users@developer", "golem15.users.access_groups@developer",
+		"golem15.users.access_settings@developer", "golem15.users.impersonate_user@developer",
+		classes.PermissionManagePrivilegedGroups + "@-",
+	}; !reflect.DeepEqual(codes, want) || classes.PermissionManagePrivilegedGroups != permManagePrivileged {
+		t.Fatalf("permissions = %v", codes)
+	}
+
 	env := newAdminEnv(t)
 	token := env.admin(t, permAccessUsers)
 	stranger := env.admin(t)