It doesn't need root credentials. The RBAC is applied on top of the credentials Aidmin is given.