Undo Checkout ideally would not require moddify permissions on files, as it mean administrators need permission to overwrite files in a workflow read-only state to gain the ability to undo a checkout when someone is out of the business ideally the permissions would be seperated for Undo CheckOut all users.