...
By default, your LAMP account will come with a permit of the form cit.lamp.<*instance name>.* or an Active Directory "permit" group in the form on cit-lamp*-<instance name>*. The initial membership of this permit will be the primary contact, the secondary contact, and all additional authorized users listed on the signup form. Additionally, the primary and secondary contacts for the instance will also have the update privilege to update membership to the permit via the ActiveRoles Server interface at https://admgmt.activedirectory.cornell.edu/permits/default.aspx (Internet Explorer required). Instructions for using the interface can be found at http://www.cit.cornell.edu/services/active_directory/howto/videos/manage_legacy_permits/index.cfm
...