diff --git a/src/main/as/com/threerings/crowd/data/BodyObject.as b/src/main/as/com/threerings/crowd/data/BodyObject.as
index bb03324a6..7118e6ac2 100644
--- a/src/main/as/com/threerings/crowd/data/BodyObject.as
+++ b/src/main/as/com/threerings/crowd/data/BodyObject.as
@@ -26,6 +26,7 @@ import com.threerings.util.Name;
 
 import com.threerings.presents.data.ClientObject;
 import com.threerings.presents.data.InvocationCodes;
+import com.threerings.presents.data.PermissionPolicy;
 
 import com.threerings.crowd.chat.data.ChatCodes;
 
@@ -193,5 +194,10 @@ public class BodyObject extends ClientObject
     {
         return OccupantInfo.X_STATUS[status];
     }
+
+    override protected function createPermissionPolicy () :PermissionPolicy
+    {
+        return new CrowdPermissionPolicy();
+    }
 }
 }
diff --git a/src/main/as/com/threerings/presents/data/ClientObject.as b/src/main/as/com/threerings/presents/data/ClientObject.as
index caee6e29d..f2fd2bbb2 100644
--- a/src/main/as/com/threerings/presents/data/ClientObject.as
+++ b/src/main/as/com/threerings/presents/data/ClientObject.as
@@ -81,6 +81,9 @@ public class ClientObject extends DObject
      */
     public function checkAccess (perm :Permission, context :Object = null) :String
     {
+        if (_permPolicy == null) {
+            _permPolicy = createPermissionPolicy();
+        }
         return _permPolicy.checkAccess(this, perm, context);
     }
 
@@ -119,9 +122,13 @@ public class ClientObject extends DObject
         super.readObject(ins);
         username = Name(ins.readObject());
         receivers = DSet(ins.readObject());
-        _permPolicy = PermissionPolicy(ins.readObject());
     }
 
-    protected var _permPolicy :PermissionPolicy;
+    protected function createPermissionPolicy () :PermissionPolicy
+    {
+        return new PermissionPolicy();
+    }
+
+    protected /*transient*/ var _permPolicy :PermissionPolicy;
 }
 }
diff --git a/src/main/as/com/threerings/presents/data/PermissionPolicy.as b/src/main/as/com/threerings/presents/data/PermissionPolicy.as
index f3e8f4767..6e2ccc57a 100644
--- a/src/main/as/com/threerings/presents/data/PermissionPolicy.as
+++ b/src/main/as/com/threerings/presents/data/PermissionPolicy.as
@@ -28,10 +28,10 @@ import com.threerings.io.Streamable;
 /**
  * Encapsulates a fine-grained permissions policy. The default policy is to deny access to
  * everything, systems using fine-grained permissions should create a custom policy and provide it
- * at client resolution time via the ClientResolver.
+ * at client resolution time via the ClientResolver. This would be an inner class of ClientObject,
+ * but ActionScript does not support inner classes.
  */
 public class PermissionPolicy
-    implements Streamable
 {
     /**
      * Returns null if the specified client has the specified permission, an error code explaining
@@ -43,17 +43,5 @@ public class PermissionPolicy
         // by default, you can't do it!
         return InvocationCodes.ACCESS_DENIED;
     }
-
-    // from interface Streamable
-    public function writeObject (out :ObjectOutputStream) :void
-    {
-        // nothing needed
-    }
-
-    // from interface Streamable
-    public function readObject (ins :ObjectInputStream) :void
-    {
-        // nothing needed
-    }
 }
 }