User roles per partition: are multiple possible?

All user accounts

This section summarizes some high-level concepts about configuring access control for all BIG-IP user accounts, whether stored locally on the BIG-IP system or on a remote authentication server:

• A user account can have only one user role for each administrative partition on the BIG-IP system.
• If a user has multiple roles on the system, the user's most powerful role is applied on first login.
• If you have an Administrator role, you can grant universal access to any user, except those that have a role of No Access.
• A user with the role of Administrator, Resource Administrator, Application Security Administrator, or Auditor always has universal partition access (that is, access to all partitions). For these users, you cannot change this universal access.
• A user with universal access can have only one role on the system, and the role applies to all partitions. On initial login, the user's current partition is set to Common.
• During a user's login session, the role for the current partition is continually displayed in the upper left area of each screen of the BIG-IP Configuration utility.
• If you change a role on a user account while the user is logged into the system through tmsh, the BIG-IP system terminates the user's tmsh session when the user subsequently issues another tmsh command.

  If you try to add another role to a user the previous role will get replaced.

   

  As a BIG-IP^{® user with an Administrator or User Manager user role, you can assign user roles to other BIG-IP user accounts.}

  Specifically, for each BIG-IP user account, you can assign a specific user role to each administrative partition to which you grant the user access.

  In this way, you can control the BIG-IP configuration objects that the user can manage, as well as the types of actions the user can perform on those objects.

  Important: When a local user with multiple roles logs in to the system, the system applies the most powerful of those roles to the user and sets the current partition to the partition associated with that role. This role remains in effect until the user changes the current partition or the user logs off the system.

  If possible you can make  2 users with different logins for serving different purpose 

  1st  Local User for Application editor

  2nd Local user for Certificate manager 

  Hope this Helps

  🙏