...
(Note this is the list from api.Permissions.Permission. It's pretty low lever and it's what controller look for in the case of secured actions)
Public -> Public (will eventually be removed)
Admin -> SpaceAdmin*Keep*
CreateCollections -> CreateCollection
...
AddInstitution -> EditUser
UserAdmin -> *Remove* (only superadmins should be able to do this) Admin