This lets us configure cross-project permissions while ourselves needing minimal permissions, but also gives us a nice hook for future lockdown of object-level permissions.