Discrepancy in bundle:start-level command and jmx ACL

ACL for command (org.apache.karaf.command.acl.bundle.cfg):

start-level = admin, manager
start-level[/.*[-][f].*/] = admin, manager

ACL for JMX (jmx.acl.org.apache.karaf.bundle.cfg):

setStartLevel(java.lang.String, int)[/([1-4])?[0-9]/,/.*/] = admin
setStartLevel = admin, manager

If I get it right, only admin should be able to change the start-level for system bundles (id between 0-49 according to the regex) through JMX, however, in karaf console the manager can set the start-level for all bundles.

And if I got the regex right, manager should not be able to set start-level of bundles with id 0-49 through JMX, but he is able to do so.