We had a client add 2 secondary repositories to their server, in these repositories Repository Users can access the system in full, but all Full Licensed Directory Server Users are read-only users unless they have the Manage Trustee privilege added to their account.
We found this through brute force changing individual settings until locking down the exact one that would free their read-only restriction.
Why do DS users need this privilege to write to secondary repositories?