docs(config): Document how to allow human operators to change their userpass password

policies/role-administrator/administrator.hcl

@@ -57,3 +57,27 @@ path "sys/mounts"
 {
   capabilities = ["read"]
 }
+
+# Allow creation of groups
+path "identity/group"
+{
+  capabilities = ["update"]
+}
+
+# Allow renaming of groups
+path "identity/group/+/+"
+{
+  capabilities = ["update"]
+}
+
+# Allow listing and reading of groups and group attributes
+path "identity/groups/+/+"
+{
+  capabilities = ["list", "read"]
+}
+
+# Allow listing and reading of entities and entity attributes
+path "identity/entity/+/+"
+{
+  capabilities = ["list", "read"]
+}