User Group Custom Permissions for Push Certificates

[coev]

This is for JamfCloud 10.0.0-t1508873342
I am trying to create custom group permissions for a group I am creating to place local branch techs. I am trying to restrict them from removing the MDM or Proxy cert under Settings>Global Management>Push Certificates. If I remove the Push Certificate rights under Settings>Jamf Pro User Accounts & Groups>"group in question">Privileges>Jamf Pro Server Objects>Push Certificates the rights are restored to full access (create, read, update, delete) after I click save. It also has the same behavior if you do this with a user with custom rights.

Is there another location to restrict rights to the Push Certificate location mentioned above? Or is this by design?

[coev]

Am I doing something wrong? Do I have a misunderstanding of the rights assignments? Still new to JAMF and it's always fun to play catch up with everyone else's prior experience. =)