In a managed access schema, which roles are authorized to grant privileges on objects within the schema to other roles? (Select two.)