Change default permissions in admincp

[Ombra]

I have my forum set up in such a way that I never use default usergroup/moderator permissions in the admincp.

It's a security risk because if I miss something, I may give someone access to something they shouldn't have. I would like to change the default permissions to something that is "always safe" for the way I run my forum so I don't have to worry about overlooking something. What code do I need to edit to change the default options?

Is bitfield_vbulletin.xml the file I need to edit to do this? Could I edit this file directly, or do I need to do it from somewhere else? I'm a bit intimidated by it, but willing to try to figure it out... I just want to make sure I'm on the right track.