Hi Chris,
The first question: there is NOT a way to do that. We have just a single permission for updating a campaign, which includes setting it on or off.
For the second question: We made a design decision in the very early days of Genesys Cloud to have our permission granularity match (more or less) the granularity of individual operations in our API; typically that's the four "CRUD" operations of creating, reading, updating, and deleting. It's true that in most cases someone with the permission to one of create/update/delete will also have the other two, but we tried to err on the side of flexibility. We also find that in some cases a permission is too *broad*, and it's harder for us to "break it up," which is another reason to err on the side of finer granularity.
------------------------------
Anthony Alford
Genesys
------------------------------