I wonder if this function can be moved out to a generic canManagePrincipal util function that can be used elsewhere as well?