thinking... i didn't think of the "remove permission `delete`" use case as i'm not looking to do that but I can see how it is related to this problem