Just setting up VNQM for the first time, the voip administrator was unable to add gateways or call managers, even with the managed nodes role. I had to add him to the admin group. Is there a role-based permission that I could have set instead of the admin role to allow him to administer just the VNQM settings?