Make permissions inline with the rbac spreadsheet, don't add delete
privileges.