You need to delegate the rights to apply PSO1 to the Active Directory objects in an organizational unit named OU1