User extra permissions with more detailed access control
Create restrictions for administrator user to prevent change on specific groups if he/she is not in these groups.