We have several clients that need the ability to create their own users and permissions.

However, we are being very cautious as to what areas of the CMS Desk we leave open for editing (particularly the Design tab).

Let's say the typical permissions for any given user starting out is CMS Desk Editor. From there, we may have one or two users that need the ability to add users. If we give them Modify permissions to users, that in turn gives them the ability to grant permissions way beyond their own. So even though we don't give them access to the "Design" tab in the CMS Desk, they can grant access to the Design tab for the users they create, as well as override the permissions we set and give it to themselves.

We need to find a way to give Modify permissions to a "User Administrator" without giving them the ability to grant permissions that they themselves do not have.