This should probably still be ADMIN. By default, don't let mods or janitors edit any of the config.

inc/config.php

@@ -1190,7 +1190,7 @@
 	// Execute un-filtered SQL queries on the database (?/debug/sql)
 	$config['mod']['debug_sql'] = DISABLED;
 	// Edit the current configuration (via web interface)
-	$config['mod']['edit_config'] = MOD;
+	$config['mod']['edit_config'] = ADMIN;
 
 	// Config editor permissions
 	$config['mod']['config'] = array(