Yup, basically its a bit handy wavey the exact semantics for the admin/visibility stuff. `is_privileged` is a basically something that goes down the read APIs to tell the clients that "this person has some power, so just let them try and do stuff and see if they get a 403"