As stated above, readout the build flag set in permissions config.yml so e.g. users in the default group with build: false are unable to build anywhere (especially non-defined-regions), except in regions where they are owner/member and regions with the flag build:allow.

oh yes please! :D