Role syncing needs permission to alter role_assignments