Comment 20 for bug 1991103

I've pushed this, including a follow-up to the documentation to add a note that the permissions must be assigned at the global level.

Thanks, everybody!