The ActiveRoles product comes with Roles (a.k.a. Access Templates) that use the native permission model to provide delegation. To perform delegation you need to identify the Role, the Trustee (in this case an OU Admin) and the scope. The first two are simple as you just select an Access Template and a user or group while the third can also be simple if you understand how to define custom scopes using Managed Units. In this video I will show you how to delegate managing email address over mail enabled users and contacts, but not mailbox enabled users or groups.