As discussed with Mark Van De Wiel we would like to have more granular permissions available in HVR. The reason for this is that the creation of locations in an HVR hub is possible by BOTH 'HUB OWNER' and READ/EXEC roles. For Sybase / MSSQL this means that it is possible for a person with READ/EXEC role to be able to create locations on any database on an instance which has had  the HVR user id permissoned. This is due to sysadmin / sa_roles being at a server level rather than an instance level. 

If unpicking individual permissions is overly complex as satisfactory resolution would be disabling the 'create location / modify location' options for READ/EXEC