A set of CEM permissions configurable via EEM that segregates duties between security, system and configuration administrators. Yellow are changes to OOTB settings and red is what has been removed/deactivated.
Thanks Guenter.
When APM 9 came out, I came out independently with my own version of this and requested that it ends up in the documentation. If it not there, there should be a Doc Bug created to add this to the official documentation.