You are right, this is not in the access control settings and it can be confusing. This is in /admin/settings/filters where you can configure each input format and set up which roles can use it.
Ah, I never even looked at this page before. Fantastic. Learn something new every day. :)
Thank you!