If a user has patrol permission but not editusercssjs, he/she cannot mark a user custom css/js page as patrolled. I don't think marking as patrolled is editing, so users without editusercssjs right should be allow to do it.
Version: 1.16.x
Severity: normal