How to restrict sub-admins from assigning users to unauthorized paths or groups?

[philipp121]

I'm currently evaluating SFTPGo and exploring whether it can support a self-service model for internal teams.
The setup I’m testing includes:

• A dedicated Role with associated permissions
• A Group representing a team
• A User and a Sub-Admin, both assigned to that Role

The challenge:
I want to isolate teams from each other, but currently I can't find a way to prevent the following:

1. A Sub-Admin from assigning a home directory or virtual folder path that reaches into another team's space.
   For example:

• Team A's data: /srv/sftpgo/data/group1
• Team B's data: /srv/sftpgo/data/group2
  Sub-Admins from group1 should not be able to set paths like /srv/sftpgo/data or /srv/sftpgo/data/group2.

2. A Sub-Admin from assigning groups to users that they should not have access to.

My main question:
Is SFTPGo designed to support this kind of shared, multi-tenant setup with strict isolation between teams, or is it better to deploy a separate SFTPGo instance per team/project to achieve proper isolation?

Thanks in advance for any clarification or recommendations!