Administer CiviCRM vs. administer CiviCRM System

Question

What's the difference between the 'administer CiviCRM' and 'administer CiviCRM System' permissions? What are some examples of system administration tasks that are permitted under 'administer CiviCRM System' but not 'administer CiviCRM'?

Answer 1

There are some implied permissions which you can see here: https://github.com/civicrm/civicrm-core/blob/3bb9adfc8b7b19d8ef5cb5e27b981bd9b61b8769/CRM/Core/Permission.php#L898

public static function getImpliedAdminPermissions(): array {
    return [
      'administer CiviCRM' => ['implied_permissions' => ['administer CiviCRM system', 'administer CiviCRM data']],
      'administer CiviCRM data' => ['implied_permissions' => ['edit message templates', 'administer dedupe rules']],
      'administer CiviCRM system' => ['implied_permissions' => ['edit system workflow message templates']],
    ];
  }

So administer CiviCRM gives you access to both system and data admin.