Not sure what you mean there - this was just to shut up the test that checks all api routes have permissions. i didn't want to clutter up the ui with permissions no user actually needs (since this will be done via smart-proxy-auth from a puppetmaster) so I added it to a sensible option - uploading facts is a form of host editing after all :)