Tenant admin controls

[martin-traverse]

A set of fixed access controls for granting access to tenant admin operations
Includes write access to policies and management of in-platform roles (if they are used)
These controls are managed by configuration and externally granted roles
They cannot be overridden from inside the platform (prevents lock-outs)