Improved the way aggregate privileges are handled

Note that there is an API change in this; aggregate privileges can no longer
be asserted!