Client Admin Functionality in a SaaS Cognos Installation

[msp_cognos]

We have a Business Need, and I wish to check out with all the brilliant folks in this forum before responding back to Business :

We are a SaaS Provider - so in our Single Cognos Server installation, quite a few different clients log in (each with their distinct Cognos Groups and Permissions).
Today we centrally manage All the Permissions + Security issues
There has been some talk going on wihin the company to see if we can have a Client Level Admin Person, one for each client, who can control some day-to-day tasks like :

   - Have Access to administer a particular Tab in the Application, for that specific Client. (That Tab should be turned ON for every user for the client X).
   - Can move content from Client X's Users' My Folder Area to this particular Tab ONLY, but not to the 'Public Folders'.
   - Set up schedules from the 'Client Tab X' entries.
   - Can set up Permission for a Report among the Client X Groups Only.
       - Important : He should not have any visibility to Client Ys' users or Client Y's Groups

So the way I see it is a Semi-Admin, or a Client Level Admin, who would work like a Cognos Admin, but only with their set of data + users + Reports

To complicate things, we currently use only 1 LDAP to manage all our users across clients