admin role access for a changeconfig (puppet) daemon?