Google Message Security for Google Apps Administration Guide - Manual (Page 87)

Chapter 5
Administrators 87
Administrators
Chapter 5
About Administrators and Authorization
Administrators have access to the Administration Console where users and
organizations are managed. Each administrator must have a user account and
assigned privileges to access organizations. Administrator privileges are assigned
by creating an authorization record. The authorization record doesn’t need to be in
the same organization as the administrator -- the authorization record can be
anywhere in the organization hierarchy. In addition, an administrator can have
multiple authorization records with different privileges assigned to various
organizations through out the hierarchy.
The privileges are automatically propagated down the hierarchy. When an
authorization record is created for an administrator in an organization, the
administrator has privileges for that organization and all of its sub-organizations.
For detailed reference information for the privileges, see The Message Security
Authorization Reference.
Administrators and the Organization Hierarchy
When an existing administrator creates a new authorization record for a user
account, that user becomes an administrator and is granted administrative
privileges and access to the Administration Console.
An authorization record is assigned to an organization. Depending on the
authority settings, the administrator is able to view and modify certain aspects of
the organization, such as configuring spam filter settings. The new administrator’s
record can be in the same organization as the existing administrator’s record or in
a sub-organization.
To provide a scalable administrative framework that can serve a large user base,
while maintaining the security of each organization, the administrative hierarchy is
linked to the organizational hierarchy.