and they wouldn't be able to create new permissions, per say - you'd need one more layer of indirection