for the sake of completeness and in case we lift the restriction on trade controller I believe we should have other trade types here, i.e. cannot CRUD AnnualReportUpload, SandboxTemplate and ValidationRule and cannot CUD Shipment & Permit. With sandbox template the thing is a bit tricky because of the dynamically defined AR classes, might not be straightforward to do in which case maybe just flag it in comments somehow.