anchor.diff:  
   schedule_replica_migration_by_index_via_rest(ScheduleNode, ProviderId, User, SpaceId, IndexName, QueryViewParams, Config, MigrationProviderId) ->
       QueryParamsBin = create_query_string(QueryViewParams),
  -    case rest_test_utils:request(ScheduleNode,
  -        <<"replicas-index/", IndexName/binary, "?provider_id=", ProviderId/binary,
  -            "&migration_provider_id=", MigrationProviderId/binary, "&space_id=", SpaceId/binary, QueryParamsBin/binary
  -        >>,
  -        delete, [?USER_TOKEN_HEADER(Config, User)], []
  -    ) of
  -        {ok, 200, _, Body} ->
  -            DecodedBody = json_utils:decode(Body),
  -            #{<<"transferId">> := Tid} = ?assertMatch(#{<<"transferId">> := _}, DecodedBody),
  -            {ok, Tid};
  -        {ok, 400, _, Body} ->
  -            {error, Body}
  +    HTTPPath = <<
  +        "replicas-index/", IndexName/binary, "?provider_id=", ProviderId/binary,
  +        "&migration_provider_id=", MigrationProviderId/binary, "&space_id=", SpaceId/binary, QueryParamsBin/binary
  +    >>,
  +    Headers = [?USER_TOKEN_HEADER(Config, User)],
  +
  +    AllSpacePrivs = privileges:space_privileges(),
  +    SpacePrivs = AllSpacePrivs -- [?SPACE_SCHEDULE_REPLICATION, ?SPACE_SCHEDULE_EVICTION, ?SPACE_QUERY_INDICES],
  +    UserSpacePrivs = rpc:call(ScheduleNode, initializer, node_get_mocked_space_user_privileges, [SpaceId, User]),
  +    ErrorForbidden = rest_test_utils:get_rest_error(?ERROR_FORBIDDEN),
  +
  +    try
  +        lists:foreach(fun(PrivsToAdd) ->
  +            initializer:testmaster_mock_space_user_privileges([ScheduleNode], SpaceId, User, SpacePrivs ++ PrivsToAdd),
  +            {ok, Code, _, Resp} = rest_test_utils:request(ScheduleNode, HTTPPath, post, Headers, []),
  +            ?assertMatch(ErrorForbidden, {Code, json_utils:decode(Resp)})
  +        end, [
  +            [],
  +            [?SPACE_SCHEDULE_REPLICATION],
  +            [?SPACE_SCHEDULE_EVICTION],
  +            [?SPACE_QUERY_INDICES],
  +            [?SPACE_SCHEDULE_REPLICATION, ?SPACE_SCHEDULE_EVICTION],
  +            [?SPACE_SCHEDULE_REPLICATION, ?SPACE_QUERY_INDICES],
  +            [?SPACE_SCHEDULE_EVICTION, ?SPACE_QUERY_INDICES]
  +        ]),
  +
  +        initializer:testmaster_mock_space_user_privileges([ScheduleNode], SpaceId, User, SpacePrivs ++ [
  +            ?SPACE_SCHEDULE_REPLICATION, ?SPACE_SCHEDULE_EVICTION, ?SPACE_QUERY_INDICES
  +        ]),
  +        case rest_test_utils:request(ScheduleNode, HTTPPath, delete, Headers, []) of
  +            {ok, 200, _, Body} ->
  +                DecodedBody = json_utils:decode(Body),
  +                #{<<"transferId">> := Tid} = ?assertMatch(#{<<"transferId">> := _}, DecodedBody),
  +                {ok, Tid};
  +            {ok, 400, _, Body} ->
  +                {error, Body}
  +        end
  +    after
  +        initializer:testmaster_mock_space_user_privileges([ScheduleNode], SpaceId, User, UserSpacePrivs)
       end.
   
   cancel_transfer(ScheduleNode, Tid, Config, lfm) ->
  
positive.code: 
  schedule_replication_by_index_via_rest(Worker, ProviderId, User, SpaceId, IndexName, QueryViewParams, Config) ->
      QueryParamsBin = create_query_string(QueryViewParams),
      case rest_test_utils:request(Worker,
          <<"replicas-index/", IndexName/binary, "?provider_id=", ProviderId/binary, "&space_id=", SpaceId/binary, QueryParamsBin/binary>>,
          post, [?USER_TOKEN_HEADER(Config, User)], []
      ) of
          {ok, 200, _, Body} ->
              DecodedBody = json_utils:decode(Body),
              #{<<"transferId">> := Tid} = ?assertMatch(#{<<"transferId">> := _}, DecodedBody),
              {ok, Tid};
          {ok, 400, _, Body} ->
              {error, Body}
      end.
  
  schedule_replication_by_index_via_lfm(ScheduleNode, ProviderId, User, SpaceId, IndexName, QueryViewParams, Config) ->
  
negative.code: -include_lib("ctool/include/posix/errors.hrl").
  -include("proto/common/credentials.hrl").
  -include_lib("ctool/include/logging.hrl").
  -include_lib("ctool/include/api_errors.hrl").
  -include_lib("ctool/include/privileges.hrl").
  
  %% API
  -export([run_test/2]).
  