[Zope] ZSyncer and acl_user permissions

How does one enable a user to use a ZSyncer instance at the root folder if the user has an acl_users account at folder /spam/eggs/ (for example) but not at the root folder? I would like a user to be able to sync content only in the /spam/eggs/ folder (and its subfolders). My ZSyncer is at the root folder, but I do not want to give the user Manager permissions at the root folder. I created a new role called "Sync" at the root folder, but I'm not sure what permissions I need to enable in order to allow the user to access the operations of the ZSyncer at the root folder. I've enabled the "Use ZSyncer" permission for the "Sync" role, but this does not seem to be adequate. Any ideas? - Kamal