Users can be granted global permissions on their employee record directly (above and beyond those granted to whatever role they are using)