If so, I’m getting a permissions error even when I’m not including those fields in a mutation

you cannot protect actions with permissions, everything is protected by default. you can only allow something