While mapping the HBI API, we've already found some access requirements that weren't originally known (ex: staleness) and will need to revisit the schema once that exercise is complete.

Result from exercise: due to descoping, only the staleness permissions (at the workspace level) are needed for naive implementation.