r7995: * privileges are local except when they're *not*