For the GUI, all users that have authenticated have admin privileges (can do everything)
For the API, there's a number of permissions per account (READ, WRITE, ADMIN, PUSH)
Because of the limited possibilities quite some use cases have too wide permissions:
SP dashboard has admin permissions so can write to anything, including IdPs
Anyone with a support role (and also SP dashboard) can create attribute manipulations. Attribute manipulations are arguably one of the most "dangerous" platform features when used unauthorized.
Proposal:
Create new permission specifically to be able to change AM's, because it's so different from the other functionality. Only users with this permission (team membership) will be able to do this. Only the users that actually need this will get this permission. So not first line support or (an adversary that has compromised) SP Dashboard.
Create more fine grained permission for use by SP dashboard, that its api account can only change SP/RP/RS and not IdP (which is much more dangerous)
Manage permissions are now relatively flat:
Because of the limited possibilities quite some use cases have too wide permissions:
Proposal: