Comment 1 for bug 1496464

A large part of what RBAC does is restrict to the tenant. 'admin' is logically equivalent to 'cloud admin' in the current implementation, so maybe we need to tidy up what we mean, or clearly delineate what a tenant admin can do versus an ordinary user can't (although i can't think of anything at the moment) versus a cloud admin.