...

Every other setup related work apart from root account initialization and permissions domain initialization can be done by ordinary transactions submitted by clients and therefore does not require genesis block related functionality.

Final Decision

It was decided to disable permission checks specifically for genesis block validation.