That said, this article cleared up a little bit of permission boundaries. It's now clearer to me that my organization is doing what the article speaks of, with cross-accounts and permission boundaries, and having the two-layer-admin clarified has not made my understanding worse. Good article.