Google Message Security for Google Apps Administration Guide - Manual (Page 90)

90 Message Security for Google Apps Administration Guide
3. At the Systems organization, our administrator has a new authorization record
with privileges limited to just reading user settings. The administrator can only
read and not modify user settings for the sub organizations IT and
Operations.
4. For the IT Support organization, our administrator’s full read and modify
privileges are restored. A new authorization record with full read and modify
privileges is assigned to this organization. And, in turn, these privileges are
inherited in the Web Group IT organization.
5. For business reasons, this company limits administrative access to the
Research Ops organization hierarchy to a select set of administrators. Since
our administrator is not one of those, she is blocked by a new authorization
record with no privileges (all read and modify rights are blank). This record is
assigned to the Research Ops organization.
Multiple Authorization Record Updates
When an administrator has multiple authorization records within an organization
hierarchy, changes to these records are updated down the organizational tree
unless an administrator changes an authorization record setting in a sub-
organization. The following example illustrates how changes in one authority
record affect the automatic updates across multiple authorization records.