Bug 18120: (QA followup) 'vendors_manage' permission fits better than full acq