revisit cascading permission design+solution
We're going to stop forcing this. Each card's permissions can be configured independently. Default permissions still work the way they used to, but there is no longer a concept of "incompatible permissions" -- if there is a conflict, it goes with the permissions on the left-side card.
