Some actions in FlowActions.php don't have 'permissions' key.
That value decided which permissions are needed to be able to get permission data for that action, based on the state of a revision.
It looks like we just never got to properly implement these.

header-related thingies probably got ignored because headers don't require any permissions. But it should still use the permission system (which e.g. also checks if page is deleted, for example)
Pretty sure none of those actions properly check permissions, because we shouldn't be able to get any data if permissions are not defined for a revision.

See https://gerrit.wikimedia.org/r/#/c/210074 where I needed to fill out view-topic-summary after starting to check for those permissions.