Shibboleth Plugin – all site admins can edit global settings?

We have the shibboleth plugin enabled and it places a link inside every site admin’s Tools area. They are then able to alter system-wide settings. I can only imagine we’re using the plugin incorrectly but I cannot think of a use-case that gives all site owners the ability to change the entire network authentication mechanism.