In insights mode after adding a namespace... A user with correct permissions can add new groups to Namespace owners, but then they cannot remove that group.

Set owners tab to use the permissions returned by my_permissions on container and collection namespaces.