See
https://issues.jboss.org/browse/KEYCLOAK-3444
It its currently limited to single realm administration. Can't define
master realm fine grain permissions. It was too much of a pain. Also
fixed the long standing issue of when admin with manage-users role could
upgrade their management permissions. I'll be working on documentation
in the next week or so and will get something in by 3.2 Final.
Regards,
Bill