Original point is point #2.

Need to evaluate how these permissions should apply to a Delegated Directory - we want to make sure that users can have the control they desire over modifications made to the external LDAP directory without affecting the functionality of the feature.

Thanks to Alexandre Rafalovitch for the suggestion.