(a) Thanks for the great walkthrough and (b) yes, this is an X-Y problem, and I guess the easy way is to sort out defaultuser’s permissions with the radio group.
Embarrassingly found my own post about a solution to this, which I had forgotten about…