...
Only system admins can configure who can SU, anyone with SU capability cannot SU to a user with system admin capability!
The SU keyboard shortcut will only be visible for people who have the SU capability
Appropriateness of SU is validated at the point of SU, so SU links will be shown for System admins etc.
The default behaviour is that System admins and JIRA admins are able to SU, access may also be granted to nominated groups (note: probably not a good idea to add jira-users into this!):
...