Actually I miss a sysadmin profile, which should be enabled to make all kind of system operations (real folders, LDAP, cron settings, email settings, plugins) which, in my opinion, should be forbidden to application administrator.

I imagine syadmin should deal with all system folders and files, cron, LDAP, SMTP settings, IMAP settings, behaviours which affect the 'system' operations, while administrators should deal with everything excluding sysAdmin jobs.

I imagine some environments in which this sysadmin figure would be important:

1. providing hosted service: so final customer could have admin privileges, but not sysadmin privileges.
2. secured customer website, where customer wants to be sure application administrator cannot change system behaviours

Regards,
Tonino