Since you are able to remove E-Mail-Addresses from the Communication Tab (Delisting from Suppression List) on the Contact Entity there are no permission settings where you can define which Security Role is able to Delist those E-Mail-Addresses from the Suppression List. In Example: a regular Marketing Employee from our Customers Side is able to delist E-Mail-Addresses from that List from a Dropdown System Warning (Contact E-Mail-Address is on the Suppression List) on that exact Warning Label. After E-Mail Marketing Journeys there are some E-Mail-Addresses that did throw Bounce category "errors", those need to be edited by workers which have the permission for that exact case and not everyone.