it also means you can tenant out these kinds of "global" permissions later, if you decide you want a "partially 'global'" staff member