Actually bypass further permission checks on `update_privileges`