This means if you only want to grant your helpdesk the ability to reset device passwords and Activation passwords (for example), then you can do so. You can be as granular as you wish, making it easy to keep people from doing the wrong things in BerryStats!
What you don't see yet but is on my test bed is 'Self Service'...an additional role that allows your users to log in with their AD credentials and perform approved useradminclient functions on their own device (screenshots coming)!