Slave db file permissions

[Cherney John-CJC030]

I apologize if this has already been answered in the archives or in a
FAQ. My searches did not discover anything.
 
How do I set permissions on the slave db files? The /etc/named.conf file
is updated when a new slave is added to the system, then the named
process takes over and does the zone transfer to get the new slave file.
The slave files aren't protected as tightly as the master files are. Is
there a named.conf zone option I can use? (I didn't see one in my BIND
books.) Is there a command line option on the named process, like -u/-g?
(I didn't see anything in the man pages.) Is it handled entirely by the
umask of the account running the named process?
 
Thanks!
jwc