The permissons are wrong for server group scoped roles: /host=master/server-config=* read-config:true write-config:false With these settings a SGSR cannot add new server configurations, even for the group it's assigned to. This is because the HostServerGroupTracker interprets the '*' as a normal server group name.
Verified with EAP 6.2.0.ER7.