...
- Set <action-attribute> to false to remove a delegation
- Allow <action<scope-attribute> to be SDDL for add/remove
- SDDL must be checked for prohibited permissions
- Add Reset as a delegation to reset permissions on an OU
- Ensure that <DEPT>-Permissions are restored after a reset on a department root.
...