There should be an Override permission in the user's permissions, with a child permission for each type of override.