Currently we assign permissions via groups and roles:
User > Group > Role > Permissions
jdoe > pe_group > my_role > edit_namespace(obj:google_cloud_ns)

For community, this makes a group for each user social auth login. We can reduce extra group creation by using pulp rbac predefined user roles:

User > User Role > Permissions
jdoe > predefined_user_role_jdoe > edit_namespace(obj:google_cloud_ns)

This will have implications on the UI for how to edit namespace owners since it would have to support reading and editing owners this way. We may also want/need to change how standalone and insights mode handle namespace owners in the backend.