I am trying to define features to be e.g. keyctl=1 on LXC container's config, either while creating it or after creation. I can see this working from my web browser when I'm logged in as root@pam. However, when I call this from a new user created in the pve realm with all permissions assigned (Administrator role) on the root path, the call gets 403 in response to either creating such a container or modifying existing one. All other calls I'm normally using are working on that account. Is there some missing special role that makes using features possible for root but not for Administrator?