If we defined these in the model then also plv8 and rest clients could have access to these as well, since we'll of course be checking the same permissions in plv8 so that we don't trust too much what the client claims they are allowed to do.