add a migration to add the new manage subject and agent permissions to the appropriate groups