try this
systemdadm is allowed to run systemctl with all of systemctls' permissions and with systemctls' identifiers
that means that systemdadm does not needs the service permissions on units

systemdadm should also not be able to manage all unit files, only generic ones and the ones local to systemd