the idea is that these utils require a set of common permissions and extended permissions

the common permissions are granted to callers of the exec macros, and the common plus extended permissions are granted to the private domain