pfexec is ineffective for bootadm

I may be missing something but I believe that pfexec is ineffective with bootadm.

The user is assigned the "System Administration" rights profile but it isn't enough or pfexec incorrectly operates.

Attempting:

user1$ pfexec bootadm change-entry -i 4 title="..."

Raises an exception from the Python interpreter after a grub-mkconfig diagnostic message: You must run this as root.

Didn't like very much this as it precludes RBAC :-)
(pprive -eD ... doesn't add anything useful to RBAC either)

Regards.