held by means of role membership, rather than directly. Per discussion and bug fix of a couple weeks ago.