I'm going for single permissions, and renaming BULK to BULK_READ. None of our write operations really count as BULK WRITE, so I'd hold off from adding that particular permission.