A user with limited filters should not be able to create new filters that exceed their own. For example, a user with no host filters can currently still create a new role and filter on hosts.
Created from redmine issue http://projects.theforeman.org/issues/7222
This was rejected upstream and I do not see this fixed in the near future. Reason: A larger design on this topic is needed for having a true organization admin. Please feel free to reopen if you think this was closed prematurely.