Restricted Roles & Privileges of HostInterface Account

To be clear, are you saying the account created via the bootstrap method is assigned the role "HostInterfaceAdministrator", meaning, the new user created after invoking the IPMI "Get Bootstrap Account Credentials" command will contain the role "HostInterfaceAdministrator"?

If this is the case, you're right in that an Administrator would not be able to PATCH or DELETE the user. However, this sounds like a potential design issue. Restricted roles are intended to be set up for service providers to have well-known access points to the system. Think of cases where a user leases a system from a third party; the third party would want to ensure they maintain their access to the system in order to service the system when the customer has an issue or their lease is up and they need to prepare the system for the next user. Setting an end user role like "HostInterfaceAdministrator" as a restricted role does not seems like an appropriate setting.

No, I don't necessarily mean that it's strictly tied to AD or LDAP. It's more for cases where ownership of a system is shared between two parties. For example, the "Contoso Server Farm Company" might lease equipment to customers. As part of the leasing agreement, their customers might have access to Redfish to perform system management. However, Contoso might need to ensure they still have access when the lease expires or other events take place. So, Contoso would have a restricted role that ensures they maintain access to the system. They likely have their own local admin account that's locked out and the customer is not able to access. I would not recommend using HostInterfaceAdministrator as a restricted role given the use case.