allow vendor_netmgrd self:capability sys_admin;