Got it thanks @Jake . Are there any drawbacks of going with the first approach of creating the two sets of permissions? Just making sure I am not going against a best practice