Question re GRANT ANY / DROP ANY

I support a COTS software application that uses an Oracle database backend. The software vendor provides a database creation script that creates two users and grants them various permissions. (snippet below)

The IT department for one of my customers is objecting to the "CREATE ANY" and "DROP ANY" statements. They say that these statements would allow the AFM user to create and delete objects owned by SYSTEM and SYS -- a violation of their policy. They suggest dropping the word "ANY" to limit the creation of objects to the AFM user's schema only.

Problem is, the application performs operations (not accessible to me) that require the AFM user to create/drop objects in the AFM_SECURE user's schema, and vice versa. Is there a way for me to allow the AFM user to create/drop object in another user's schema without using "CREATE ANY" and "DROP ANY?"