There needs to be a privilege option to either approve or restrict the ability to merge clients. Because this action is final it's quite dangerous to allow anyone with a log in to be able to perform this function.