Probably GlobalMatrixAuthorizationStrategy.PermissionAdderImpl.add should call Jenkins.getInstance().save() before returning true. Otherwise adding ADMINISTER for the first user does not seem to take effect on disk until you resave the main configuration screen.