David and I talked about this.  The idea is that managers would be able to manage their objects when they were away from their whitelisted ip.  Users from the restricted areas would not have managerial permissions.