It was found that a tenant administrator could create groups with roles that have higher permissions than those of the tenant administrator.
Acknowledgments: Name: Matouš Mojžíš (Red Hat)
This issue has been addressed in the following products: CloudForms Management Engine 5.7 Via RHSA-2017:0320 https://rhn.redhat.com/errata/RHSA-2017-0320.html