While works has been done on #13164 we agreed that the current permission split for all kinds of parameters we have is a it confusing. We have 3 permission sets now, one two for lookup keys (smart variables + smart class parameters) since 1.12 - #14546, one for Global parameters and one for the rest of "global" parameters e.g. DomainParameter. It was suggested adding params permissions per resource, e.g. for Host resource there would be edit_parameters. Another possible solution would make sense to split permissions per parameter type e.g. Domain parameter, OsParameter etc. In such case we could add also auto-completion.