We added stricter privilege requirements for some internal collections. The builtin root role doesn't have currently this, but it has the right privilege to grant itself this privilege. We should just add it for convenience.