I have since learned that the customer is using the CloudBees Role-Based Access Control Plugin. I'm not sure there is going to be a way to migrate those permissions, since they won't be able to use the plugin