This should be done via the group permissions. If it doesn't work, then check that your
testing it correctly and that the test user doesn't belong to a group which has sticky rights.
FWIW, the permissions.xml is just the data used to create the admin display. Changing this without verifying that the underlying code which processes the form may cause unexpected results.
[originally posted on jforum.net by monroe]