you're embedding it as a scripting api and want to limit permissions to just what's needed