Individual Creation of SLA/User/Identity (tenant based account)

Dear IBM,
Our customer Requires
Ability to create his own SLA policies and assign VM's/DB's/Filesystems in it.
Ability to create his own users and assign him role of limited capability
Ability to create his own identities (for inventory of VM's mostly)

Currently this is possible only with assignment of resources ALL. For example SLA-> ALL, User -> ALL, etc. This however give him access also to system based users, SLA responsible to server maintenance (catalog backup) or other customers SLA which is from security point not possible.

Therefore we need function which will enable us to give specific customer user permission to create new SLA/User/Identity without granting him all permissions. The newly created user should then be assigned as resource to the user who created him so he can manage him. Alternatively it can also work with higher definition of Tenant which will create separate customer structure of his resources (vcenter, Users, etc).

Required user structure:
SuperUser - default account, available to Backup admins only
|
ˇ
Backup admins - Responsible for backup infrastructure.
|
ˇ
SQL, VMWARE, LINUX - responsible for OS / app , admins within company, access to all backups per type (Linux|Win|VMware|SQL|etc), no access to config settings, server settings,
|
ˇ
Customer super account - outside of company, no access to config settings, server settings, etc, access to all customer backups, able to create own users.
|
ˇ
Customer accounts per project - outside of company, no access to config settings, server settings, etc, no access to all customer servers just assigned ones.

Thank you.