do not have default etc EveryEntity privs

Gettes: We have grouper configured as “default deny” for viewing in the UI. An unpriv’d user logins to grouper and should only be able to see what they need to see. In etc: the attributes:entities:* and attributes:permissionLimits:* appear to be visible to EveryEntity (privs are read,update). Is this intentional/necessary? I am hoping to limit questions from users as to “what’s this?”