Unfortunately, yes this requires upstream changes. I actually spent quite a bit of time looking into this and I haven't been able to figure out which part of the phabricator code is enforcing this or how I would go about changing it.

If you do this:

• Applications → Maniphest / Configure → Edit Policies → Can Configure Application and set it to "Administrators, and also Alice (who is not an administrator)"

...where does Alice hit a permissions error? It seemed to work for me locally when I did it just now, but maybe I didn't do the right thing.

For the records, this obstacle was brought up again in a conversation about WMF's onboarding documentation with WMF's Architecture team...

I'm happy to take a look at this if someone with access has a chance to figure out where it isn't working on your end -- my expectation is that it's supposed to work, but I could definitely have overlooked something.

In T181031#6673833, @epriestley wrote:

I'm happy to take a look at this if someone with access has a chance to figure out where it isn't working on your end -- my expectation is that it's supposed to work, but I could definitely have overlooked something.

Hello @epriestley, unless @mmodell disagrees, I think this is resolved as per T227267#5709153.

Thanks - this is "our fault". On https://phabricator.wikimedia.org/applications/edit/PhabricatorHeraldApplication/ , Can Configure Application is set to Administrators. Changing that would likely first require some concept of managing groups and groups' membership in WMF...