A root-level administrator can define one vsys admin with read-write privileges and one vsys admin with read-only privileges per vsys.