Well yes, that's true. They do have elevated permissions. I didn't know they resided locally though, I thought they just used cache manifests.