Roles and permissions

Completely off topic I know; but that glossary link can't be right...

Basically, the difference is that Manager is a normal role, but Administrator is a special case.

What I mean is that Manager is a normal role just like any other. You can edit the role definition, and grant or take away capabilities to control what managers can do.

On the other hand, Administrator is not really a role. If you are an administrator, then the code automatically gives says "yes" when checking whether you have any capability. So you can do anything.

(In addition, there are a very few things that are only possible for the administrator to do, rather than being controlled by capabilities. For example, only an Administrator can edit another Administrator's user profile for security reasons. A Manager can edit any other user's profile, but not an Adminstrator's.)

The upshot of this is the following recommendation:

For day-to-day administrative tasks, use the Manager role. Just keep one Administrator login around for emergencies, but store the password "in the bottom of a locked filing cabinet stuck in a disused lavatory with a sign on the door saying 'Beware of The Leopard.'"

For example, if a Manager edits the role definition for Manager and does something stupid, they may lock themselves out of the system. In that case, you will always be able to log in as Administrator, and fix the problem.