The permissions check is run in a system context (or not re-run for every page view), so it's ineffective.

The permission needs to be checked:

• in the action itself (e.g. the index.jelly) to fail when configure permission is missing (for those clever users navigating to known URLs directly)
• as well as the action.jelly that needs to be added for this