Your organization wants to restrict users who have administrative permissions at the organization level. Which two roles should you restrict? (Choose two.)