I concluded that RENAME should require CREATE privilege on the namespace as well as ownership of the table.