The manual should say admins with system privilege OR unrestricted or
restricted policy privilege can do this.

If you give your platform specialists restricted policy privilege to one (or
more) domain, they can register, unregister, lock, unlock, and change
passwords for nodes in that domain only.   They can't affect clients in the
OTHER policy domains.

I do this for several groups, for just the reasons you describe.  Greatly
helps offload work from us system admins!