more flexibly grant permissions for user groups who can manage icons of other users