Administrators can manage developers by specifying which users and groups have access to application content.
Sample developer permissions
Several things that you will need to setup:
When creating a new app a user role is automatically created, you will need to create an additional admin role and associate all the advanced capabilities like delete ACLs, etc to this admin role versus the user role.
In ACLs there is an "admin overrides" attribute. This will need to be set to false for all ACLs in your custom application. This will ensure that normal admin's don't override this ACL and they gain CRUD (create, read, update/write, and delete) access
Make sure the navigation menu items are associated to your user/admin role so they don't see it in the application navigator
Admin's obviously have to elevate their privileges to security_admin to modify ACLs, make sure you log when users do that so you have traceability
Through process I would advise that admins be general users in your production instance and create a request process to gain admin role/activate their admin user only when needed
The only exception (i can think of) is the security_admin role. This isn't automaticly assigned to the admin role but needs to be manually toggled. by clicking on elevate roles as shown below.
