This policy setting allows you to specify whether SECROLE_USERAUTH has system administrative privileges on the device, without ...

"This policy setting allows you to specify whether SECROLE_USERAUTH has system administrative privileges on the device, without modifying metabase role assignments.  If you enable this policy, then only SECROLE_MANAGER has full administrative access to the device.  If you disable this policy, then both SECROLE_USERAUTH and SECROLE_MANAGER can obtain full administrative access and users can potentially alter device security settings.  If you do not configure this policy, then existing device-specific policies for system administrative privileges are applied."