Tested with the usual case in mind, being "I want to give my client the ability to create new path aliases but not give them anything related to pathauto, including bulk delete stuff"
Given the permissions as per attachment, the user with Content editor role now only sees the alias addition functionality in /admin/config/search/path - the "Bulk generate" and "Delete aliases" tabs are no longer there.
So works as I was hoping it to.
"Administer pathauto" or correct one of the new two permissions is now required to access those aforementioned two tabs.
PS. Only tested the functionality from Drupal UI using DrupalPod, did not review code.
Patch seems fine, eagerly waiting for a D10 compatible version.
tormu → created an issue. See original summary → .