Thanks for the information Jason. I suppose it is possible to grant privileges to sub-trees of "ch.qos" to specified users?  The docs mention a "privileges" button in the UI but I can't see one. I guess I would need to file a jira issue and request privilege changes.