BESx with ZCB 6.5 / should non-global administrator be enough?

[th_]

i'm running 6.0.8_GA_2661 NETWORK edition with multiple domains.
each domain has it's "domain-administrator" (non-global) to manage users in that domain.

the customer behind one of the domains wants their blackberrys connected so i put a BESx in their network.

if i understand the documents (beta program for ZCB6.5) correctly, i shall create a besadm account with global-administrator status and pass the credentials to the ZCB software.
now that rings alarm bells in my head, because that basically means passing global-administrator privileges to that customer.

shouldn't the permissions of a domain-administrator be sufficient?

using the zmsoap command-line utility i tested with the domain-admin credentials and could successfully list all that domains users. (AutoCompleteGalRequest).

just passing the domain-administrators account to the ZCB (when creating mapi profiles) has the effect that BESx can not create any user.

thanks
--