You need to allow the Server Access Team group to grant permissions for the application servers without granting the Server Access Team group unnecessary permissions