Migrate privileges from csm to nextgen model