Many common administration tasks require a coordinated set of privileges. Some operations require permission at the root access group, or at the federation root access group in a Cloud Pod Architecture environment, in addition to access to the object that is being manipulated.
