Hi there,
Read the 2 links below. One is a solution offered to a similar question, the other is the implementation guide which will offer better explanations of the roles and permissions.
https://www.symantec.com/connect/forums/altiris-management-scope-permissions
https://origin-symwisedownload.symantec.com/resources/sites/SYMWISE/content/live/DOCUMENTATION/4000/DOC4217/en_US/Altiris%20Client%20Management%20Suite%207.1%20from%20Symantec%20User%20Guide%20for%20Mac%20Management.pdf
Thanks!