Why does Argo Rollouts dashboard require Deployment.apps Patch permission to Rollback a rollout revision?

[Desolar1um]

Hi,
I'm testing the Argo Rollouts dashboard, and was trying a rollback on a rollout. This failed with the following error in my k8s audit logs. I feel like the only permission it should need is replicaSet and Service related in order to spin back up the old one, and update the service.

deployments.apps "useragent-resolver" is forbidden: User "system:serviceaccount:argo-rollouts:argo-rollouts" cannot patch resource "deployments" in API group "apps" in the namespace "accounts"

I haven't found an explanation of permissions required in the documentation, hoping to get some clarity here.
Thank you!

Edit: I am using the workloadRef field to reference my old Deployment. I'm assuming that has something to do with it.