the answer is that this is a level higher than even elevated privilege - MAINT - which only ServiceNow have not the local instance admins. Will be interesting to see if ServiceNow addresses this in future releases to open up the role to sys_admins

WORKAROUND: can add a custom UI action to enable adding this

condition: gs.hasRole('admin')