you need permissions granted directly through you, not through a role