more permissive grants for in-app log writing