Limited create administration permissions

I’d like to configure Keycloak to allow users limited realm console access to be able to

  • create roles, but not modify any existing roles
  • create a group and map the roles they have created to the group, but not modify any existing groups
  • create a client, and configure that client, but not modify any of the existing clients

I can’t determine if this is possible, or how. Is this possible?

As a follow up, it seems like it isn’t possible to grant a user the rights to use the realm console to create roles without giving them manage-realm, which gives them quite a lot of power.

Is it possible to give someone the ability to create roles without giving them the ability to see all the rest of the realm configuration, let alone change it?