I have set up a user group named Administrators, to be used for the person in charge of managing the website day to day. But I didn't tick the Admin box as I don't want them to be able to access plugins or updates etc.
I want them to be able to create users and fine tune the permissions of the users they create. So I ticked all the boxes in the User section. But if I log in as that Administrator I am allowed to change my own permissions (and all the other users) to access plugins.
This can't be right, how do I prevent them increasing their own permissions beyond those I have allocated them?