We wish to have local administrators with access to update person and group documents for their region only. This must include email information.
As I understand the NAB, Email information fields are restricted to editor access and above. However, having editor access would override security in that the local administrator would be able to edit any documents.
I considered using the people modifier role. But this does not give enough access to change the email information, and it gives too much access, as the local administrator would be able to edit all the person documents, not only the local ones.
I considered using the local administrator group in the owner field of the appropriate documents. Once again this did not give access to the email information. I had hoped that requests in the admin client would be recognized as valid and create adminp requests. However, it seems that the administration client tries to perform the changes directly into the document.
I also considered using an Extended ACL. I do not know this part well and have not found a good answer here. It seems to me that this works well if you divide administration across OU boundaries. Unfortunately, our company users a single OU and made a conscious decision to do so.
I am at a loss for how to set up this local administration scheme. Does anyone have any good ideas?