Without this rule, an organization_admin can take control over a global_admin account, and then access everything through this account.