To set permissions on a virtualized service, you must have the Full instance-level permission on the native service from which the service was generated (or you must belong to a role that has the Manage Assets permission).