Assuming I'm not super admin, but regular admin and I have permission to template, but no permission to host. On template I have a web scenario with web step.
When updating web scenario via API, I'm adding only new steps, and thus deleting old ones.

httptest.update

{
"httptestid":"86",
"steps": [

{ "name": "Homepage 4", "url": "http://mycompany.com", "status_codes": 200, "no": 1 }

]
}

It successfully updates template web scenario, but on linked host child, the old web step still remains and new step is added. Now template has one step, but child has two steps. It couldn't find the previous one and delete it, due to permission check, and it created new one.