Depending on the action, aren't these operations tied to a specific index? At least in some cases, it seems like this resource should  require {?YZ_SECURITY_THING_ONE, Index} as a permission.