Merging candidates and prospects was previously limited to Site Admins, since they automatically have access to all candidates on non-confidential jobs. We then rolled out Auto-merge in the hopes that a vast majority of duplicates could be caught and triaged before a human every needs to look at them. The sad reality, however, is that some cases will always need to merged manually, and you should have some control over who can do that.
Our newest Job Admin level — Can merge candidates and prospects — allows you to grant Job Admins permission to merge profiles on a job-by-job basis.
In order to avoid permissions escalations via merging, a Job Admin must have the exact same Job Admin level on both profiles in order to merge them. For example, if someone tries to merge Candidate 1 (who is on Job A) with Candidate 2 (who is on Job A and Job B), they would need to ensure they had the same job admin level on BOTH Job A and Job B in order for it to go through. If a Job Admin attempts a merge where they do not have the same permission on every profile, an error message will appear warning that they lack the permissions for the action.
Depending on the number of users who will be merging candidates and prospects, it might be helpful to create an all-new Job Admin level called Job Admin: Merge (or something similar) so you can ensure that the people responsible for cleaning up duplicates are always assigned this level.