Defender MDO permissions broken (again)

Defender wasn't letting me approve pending AIR remediation options, something I do every day, with my usual custom RBAC role checked out.  Nor could I move or delete emails.  I also had Security Operator checked out.  I checked out Security Admin and tried again, no dice.  It wasn't until I checked out Global Admin until I got the permissions I needed.