@reptar @James Morris good one, best practice admin should create a custom role with "NO Permission" and follow the process above. This will give you un obstructed permission error, becasue sometimes you might need multiple permission for a single task.