I would expect super admins to be able to cut or set authorisation access but not actually control that. In which case, wouldn’t super admin hijack just amount to DoSing 3rd party systems, rather than compromise?