[keycloak-user] How to configure keycloak management client to allow users manage a subset of other users?

Hi all, My question is more about how to configure and create a structure to manage the Keycloak without expose my api with any security problems... So, I belong to a governamental organization, and we choose keycloak to manage our applications. So, my application would have three kind of users: administrator, superuser and common user, and all of these users has an special attribute named "organizational unit". So they belongs to different governamental organizations (each "organizational unit" is a governamental entity or organization) So, I'd like that my administrator have permissions to manage all users in keycloak, and my superuser has permissions to manage only the common users that belongs to the same "organizational unit" of him. So, How can I configure this with keycloak? I believe I have to configure the client "Realm-Management" to do that, but how could I allow superusers to manage the common users in the same "organizational unit"? I can't use different realms because I have only one application for that! Best regards, -- --- *Celso Agra*