As you could probably tell from the vestigial tuples from above, I originally set per index permissions. But realistically, it seemed too narrow. The only thing you can do with an index is get its information, which you could get from a list. Same goes with schema. You can't actually update anything. I can add per-index grants back, if anyone has strong feelings about it.