We'd like to have help desk users remediate incidents but not be able to install/uninstall agents or rename orgs.