Currently, "Cancel marked holds", "Suspend all holds", Resume all suspended holds", "Suspsend?", "Delete?", etc all appear on circulation.pl even when the staff user doesn't have permission to manage holds.