Currently, name groups and filters (/api/name_groups, /api/filters) can be edited (put, post, delete) by any logged-in users, without special edit permissions. I think this needs to change, the question is whether we use the same permissions as for primary objects, i.e. Contributors can add, Editors can edit and delete, or different ones. Custom filters are a special case as they are not specific to a tree but shared for an entire Gramps installation, stored in an XML in the config directory rather than the family tree database.