Well I don't want that.
I want to prevent edit/save operations on everything but Systems from
users outside admin.
You can't prevent new systems, but you can lock down the ownership of
existing systems to certain
users/groups.
Third, even with the simplest configuration, where I'm a member
of admins,
I can't seem to edit anything.
See previous email on what I think happened there.