Sometimes even when a user has rights to  view and modify some stuff on a resource and to execute operations, the user may not supposed to run some "dangerous" operations.
E.g. an operation deleting some target thingy (e.g. clean up log files, which should only be done by some specially trained people after auditing).
We should add a way to flag such operations as requiring additional rights.
If the user does not have the rights, the operation is hidden in the UI and execution will always result in a failure.