My company's rules deny permissions for Read("secret") but not "mv secret not-secret" :-/