I didn't tell to forget about configuration(so modifying configuration files is the only means to configure by your definition?), as I gave one opinion how it could be done, I said to forget how it's done in Minecraft as how it's done there would open possibility for abuse and/or security loopholes here(meaning the need to load the configuration files from the user to the server, do I need to explain further?).
A beacon like system to control the permissions probably is the best way to do it and most well integrated to keep the immersion to the game. Perhaps they could reuse the old beacon system in the private worlds as the capital beacons we have now but they would cover the whole world(they would still need to make an block or object to inter act with the beacon though).