We were talking about setting permissions per resource type, but the current API calls don't have a way of figuring out which type a given ingested asset would belong to.
The simplest idea would be to allow users to declare a type in the ingest screen, but this leaves room for user error. Need to discuss whether this is acceptable.