diff --git a/changelogs/4.0-snapshot.md b/changelogs/4.0-snapshot.md
index e022613d3..2aceb99ea 100644
--- a/changelogs/4.0-snapshot.md
+++ b/changelogs/4.0-snapshot.md
@@ -545,19 +545,47 @@ This version features substantial changes to the network system, improving coher
 - `upnp\UPnP` has significant changes. It's now a network component instead of a pair of static methods.
 
 ### Permission
+- The following new permission nodes have been introduced:
+  - `pocketmine.group.everyone`: granted to everyone by default
+  - `pocketmine.group.operator`: granted to operator players and the console
+  These permission nodes can be assigned and overridden by permission attachments just like any other, which means it's now possible to grant **temporary operator** status which goes away when the player disconnects (or the attachment is removed).
+- Permissions are now always false if they haven't been set explictly, or granted implicitly by another permission.
+- Undefined permissions are now always `false` instead of following the value of `Permission::$DEFAULT_PERMISSION`.
+- Permissions internally no longer have default values. Instead, they are now assigned as a child of one of the `pocketmine.group` permissions:
+  - `true`: add as child to `pocketmine.group.everyone` with value `true`
+  - `false`: do not add to any permission
+  - `op`: add as child to `pocketmine.group.operator` with value `true`
+  - `notop`: add as child to `pocketmine.group.everyone` with value `true`, and to `pocketmine.group.operator` with value `false`
+  However, the `default` key in `plugin.yml` permission definitions continues to be supported.
 - Added `PermissibleDelegateTrait` to reduce boilerplate for users of `PermissibleBase`. This trait is used by `ConsoleCommandSender` and `Player`.
 - The following API methods have been moved:
   - `Permission::getByName()` -> `PermissionParser::defaultFromString()`
   - `Permission::loadPermissions()` -> `PermissionParser::loadPermissions()`
   - `Permission::loadPermission()` -> `PermissionParser::loadPermission()`
+- The following constants have been moved:
+  - `Permission::DEFAULT_FALSE` -> `PermissionParser::DEFAULT_FALSE`
+  - `Permission::DEFAULT_TRUE` -> `PermissionParser::DEFAULT_TRUE`
+  - `Permission::DEFAULT_OP` -> `PermissionParser::DEFAULT_OP`
+  - `Permission::DEFAULT_NOT_OP` -> `PermissionParser::DEFAULT_NOT_OP`
 - The following API methods have been added:
-  - `PermissionParser::emitPermissions()`
   - `Permission->addChild()`
   - `Permission->removeChild()`
 - The following API methods have been removed:
+  - `Permissible->isOp()`: use `Permissible->hasPermission(DefaultPermissions::ROOT_OPERATOR)` instead, **but you really shouldn't directly depend on a player's op status, add your own permissions instead!**
+  - `Permissible->setOp()`: use `addAttachment($plugin, DefaultPermissions::ROOT_OPERATOR, true)` instead to add, and `removeAttachment()` to remove it (or addAttachment() with false to explicitly deny it, just like any other permission)
   - `Permission->addParent()`
+  - `Permission->getDefault()`
+  - `Permission->setDefault()`
+  - `PermissionManager->getDefaultPermissions()`
+  - `PermissionManager->recalculatePermissionDefaults()`
+  - `PermissionManager->subscribeToDefaultPerms()`
+  - `PermissionManager->unsubscribeFromDefaultPerms()`
+  - `PermissionManager->getDefaultPermSubscriptions()`
+- The following fields have been removed:
+  - `Permission::$DEFAULT_PERMISSION`
 - The following API methods have changes:
   - `PermissionParser::defaultFromString()` now throws `InvalidArgumentException` on unknown values.
+  - `Permission->__construct()` no longer accepts a `$defaultValue` parameter (see notes above about defaults refactor).you should add your permission as a child of `pocketmine.group.everyone` or `pocketmine.group.operator` instead).
 - The following classes have been removed:
   - `ServerOperator`