'modify' is one of the "owner" permissions. The only thing that owner doesn't have is 'zope.Security'. Though with the current implementation it's not needed, indeed.