Each Organisation has set of permissions, grouped into categories of:

• sys-admin — users who can do any global administrative action
• sys-apps-admin — users who can create and modify the state of applications
• sys-provisioner-admin —
• sys-users-admin — users who can add/modify other users

These groups in turn allow adding other groups (you can create a group called ‘my-admins’, add it to sys-admin, and then add users to it).

A user may be a member of multiple of the administrative system groups.