Set the range of privilege,include:

System,it can manage the entire system and all users under the system.

Team,it can manage users under the team.

User,general user,it should select team to join in.