pt-online-schema-change's triggers fail with "DELETE command denied" on insert
The issue turned out to be that the triggers that the pt-online-schema-change tool creates for insert and update use the REPLACE DDL command of MySQL, which requires the DELETE permission to execute.