Since all administration of zones is done through the UAA zone, the uaa.admin serves as super admin
Furthermore, zones.create is the only action that should be allowed as client_credentials
A zone update, and any management in a zone, should require zones.{zone_id}.admin
https://www.pivotaltracker.com/story/show/86812618
[#86812618]