Revo: Limit users maximum role to add/modify

I’m working on a site in Revolution and have been changing permissions so client can manage users but not all sort of other tasks. The problem is, the limited user can still see and modify all users, even above it’s authority. In addition, the user can modify their own role within the group assigning greater authority. Am I doing something wrong, or is that how the access permissions work at this point with revolution for user account management?