Actually, by trial and error I nailed it down to a combination of edit_users
and manage_network_users
. If I add those two capabilities to a user that otherwise just have the read
capability (like a subscriber) then the add term button appears and works.