Customer Admin appears to be able to access all, granular permissions would be nice.