I have defined a number of classes to segregate the accounts as per required settings & tweaks based on roles in the organization.

I have delegated some rights to minor admins where I need to to allow them to change the class of an account to only a particular class if it belongs to default class.

The issue comes when I provide this right of class modification, they get complete rights in regard to class modification of an account which has some undesirable side-effects.

Is it possible to restrict the class modification to some particular class only & not any class.

Same issue goes with groups modification rights. Currently group modification rights include both appending as well as deleting members.

I want to restrict minor admins to be able to only append to some particular groups only & not be able take any action on the other groups.

In a big organization such a requirement is a necessity otherwise safe delegation of rights to minor admins becames scary. Thanks