* as long as they have the "trusted-user" role, which is required to
  create the record in the first place
* however, publishing new records still requires the "trusted-publisher"
  role