Maybe a separate permissions in the facts group?