diff --git a/radicale/config.py b/radicale/config.py
index 465a882b..54058d32 100644
--- a/radicale/config.py
+++ b/radicale/config.py
@@ -66,6 +66,13 @@ def positive_float(value: Any) -> float:
     return value
 
 
+def rights_permission(value: Any) -> str:
+    for permission in value:
+        if permission not in rights.INTERNAL_PERMISSIONS:
+            raise ValueError("unsupported permssion %r found in: %r" % (permission, value))
+    return value
+
+
 def logging_level(value: Any) -> str:
     if value not in ("debug", "info", "warning", "error", "critical"):
         raise ValueError("unsupported level: %r" % value)
diff --git a/radicale/rights/__init__.py b/radicale/rights/__init__.py
index ad5ff9b6..c70f0f6e 100644
--- a/radicale/rights/__init__.py
+++ b/radicale/rights/__init__.py
@@ -43,6 +43,8 @@ from radicale import config, utils
 INTERNAL_TYPES: Sequence[str] = ("authenticated", "owner_write", "owner_only",
                                  "from_file")
 
+INTERNAL_PERMISSIONS: str = "RriWwDdOoTtMm"
+
 
 def load(configuration: "config.Configuration") -> "BaseRights":
     """Load the rights module chosen in configuration."""