RA-397 - Roles and privileges for top-level administrative apps