Change folder privileges so that instead of the STEM privilege, there is an ADMIN privilege on folders. The ADMIN privilege would mean you have all rights to the folder, you can rename it, delete it, change privileges, and effectively every other privilege. The CREATE privilege would be changed to also include creating folders (in addition to groups and attributes). And the STEM_ATTR_READ and STEM_ATTR_UPDATE would remain the same. Note, so the name doesnt conflict with the group ADMIN privilege, the stem privilege will be called STEM_ADMIN.