Granular user management permissions

Workaround

Using an API key "Space admin" on the root space

Problem

We have a process that sync's users slack IDs into Spacelift for use with the Slack integration, which calls the "managedUserUpdate" GraphQL mutation to update users. Currently we have to give this a key with Space admin on the root space, which is far more permissive than we'd like. More generally, it seems that any organization level settings currently require these privileges, which are likely more permissive than needed in many cases.