add a systemPrincipal global to services.principals.  pass this with findXXX commands that need system level wide access unconstrained by visibility rules.