Important rules for N1 System Manager security administrators are:
You can securely configure a non-root N1 System Manager user to have only security administrator privileges by adding only the SecurityAdmin role to the user. Such users cannot extend their own privilege set, either by adding new privileges to the SecurityAdmin role or by adding new roles to their own user account.
You cannot configure the root user to have only security administrator privileges.
You cannot configure a user to have only security administrator privileges if the user has the SecurityAdmin role and a custom role added to it. Such users could use their SecurityAdmin privileges to add any privileges to the custom role and therefore extend their privilege set.