We want the roles and permissions configured in the behaviour module to apply to incident creators as well. For example, a Basic user should not be able to change the permissions of users added (by either Default Outcomes or RnP) to give them a higher access within an incident to ensure confidentiality.