In the API-viewer you can see the permissions for the different options, and some of them do require a certain permission for a certain node.
If you set the permissions without recursiveness (or low enough in the tree) you can set it to specific nodes / storages / etc.