This was mentioned somewhere else by someone else but I cannot find it anymore. So - just to make sure it gets captures, here's the gist of it.
1. As part of permissions and visibility, the LEADS object should be added so general visibility settings for leads can be set by an admin.
2. Similar to the way this works for ORG/PERSON/PRODUCT and DEAL - one should also be able to override these settings on a lead by lead basis.
3. This then consequently also means that several permission sets need to be added for leads:
- Add leads
- Edit leads
- Merge leads
- Delete leads
4. And that the permission "change the visibility of items" need to be expanded to now also include LEADS.