When defining a role, you can allow or deny the acces to the complete area of User management.

But, an Admin who is a Zabbix Administrator, he can not check for the correct rights for his subordinated users, making some trouble shootings dificult or impossibles, like knowing why those users are not receivig notifications. 
It will be nice to have a read only right over certain areas.
This can also be achived calling a configurable validate function before the execution of any task (click button)