Splunk App for VMware 3.1.3: How to remove "admin_all_objects" from the VMware admin and still allow them to control the DCN's?

[hartfoml]

I am new to the Splunk App for VMware.

I gave my VMWare admin the "splunk_vmware_admin" user role in Splunk.

He said that and now he can see all installed "Apps" and "Reports" that he didn't use to see.

How can I take away the "admin_all_objects" from the VMware admin and still allow them to control the DCN's?

[jcoates_splunk]

$app$_admin roles are additive to Splunk's native admin roles -- you're stating "this is a Splunk admin who can also admin VMW", not "this is a Splunk user who admins the VMW app".

[hartfoml]

My VMware admin is not a splunk admin. I want to delegate the VMWARE admin role to the VMware Admins and not have them admin all of splunk. Is this possible?

One of the Capabilities showing for the splunk_vmware_admin is admin_all_objects

This essentially gives the "VMWare Admin" the right to be a "Splunk Admin"