I'd like to manage this with a Permission Set rather than Delegated Administration because I CAN move a Permission Set through sandboxes and CANNOT move Delegated Administartion.
Given this, what permissions does that Permission Set need?
I've seen this thread (https://success.salesforce.com/answers?id=90630000000gyDBAAY), but the answer ended up being "use delegated admin".
Any advice?