You are right, I got lost in tracking down the whole privilege chain