separate foundation allowlist for user admin #1528
Description
We would like to provide user adminstrators with the ability to ban/unban users, create/update access-passes but not give them other privileges that the foundation allowlist has with respect to contributors/device/links/etc and global config settings. This increases the ability to distribute user administration load, while minimizing risk to the network.
It's possible in the future that we might like contributors to be able to ban/unban users only on their own devices. This is a longer discussion, but something to potentially consider in the design.