That's a commong thing in permission / capabilities. Either the system is not expressive enough, either you get "false positives" and bounties included.