Best practices for user permissions based on schema relationships

Bumping to remind to update once/if RBAC is merged in.