I have a client with an existing ACS 4.2 install base. In their configuration they have several ACS administrators configured so that they are only allowed to add / edit users in a particular group. The control is defined under Administration Control...