Allow creation of users at the enterprise dashboard who cannot view/modify policies, users, or settings at the enterprise level but can be set as admins on one or more sub-estate.

For example
A user could have read only at enterprise and Admin on sub-estate 1 and sub-estate 2 but no access to other sub-estates