How can permissions be setup so that a group of users can dispense from Containers but not be allowed to otherwise edit the Containers?