Add initial per-object admin permissions