View and edit the user's own fields:
Password
Name
Email
Address
City
State
ZIP
Country
Phone

Much of this will be through forms provided by the corresponding tool, forms that communicate data with AcM, but without the need or opportunity for the user to log into AcM directly.

View and edit all the fields of the User Access form for all users of the account, including to delete users except the account's Primary Sysadmin.

In AcM's Alias section, a Sysadmin may designate aliases only from among the users under his (sub)account, but any tool within his (sub)account.

Note that this raises the possibility of a Sysadmin managing user access rights to tools to which the Sysadmin himself has no access. This is not a problem since the Sysadmin can edit his own User Access form anytime to add access to any account tools.

Same as a regular Sysadmin except also has access to the Billing Record for a tool within the account. Each tool gets a Primary Sysadmin as its first user. Two tools available to users of one account may have two Primary Sysadmins, each responsible for the billing of each tool.

A tool's Primary Sysadmin may not be deleted by anyone, not even a Sys Manager. A Sys Manager, however, may delete an account or the account's access to a particular tool, in which case the deleted tool no longer has a Primary Sysadmin.

May view, edit, and delete any user and any account within AcM. Full access to all data and all commands within AcM.

In AcM's Alias section, a Sys Manager may designate aliases from among any AcM user from any (sub)account..

The only way to become a Sys Manager is by manual programmer intervention. Once a user attains a SecLev of Sys Manager, that user can change his Access Meister SecLev picklist value to any other value, perhaps to see what a regular Sysadmin sees, and only that user may change his own Access Meister SecLev picklist value back to Sys Manager.