For startinblox/applications/sib-app#346, I made the permissions such that any authenticated user could add, view and change any customer. Customers can only be deleted via the admin site

This is very open, but I'm not sure who else should have these permissions? As multiple projects can have the same customer, it's not as simple as "the admin of the project"