we both are talking about the same thing
Just to be sure i checked on my console what your (limited) possibilities are:
under the users you can make groups and individual users in those groups.
On every individual task that you have in the console you can set ACCESS RIGHTS (right click on a task), tehre you have to add/remove the groups and rights for those groups.
So you can make groups and assign those to the tasks with some rights, but i dont know how much more control the users that can login get over system settings.
Its a very labor intensive way tho, but thats how you can (partially) do it.
Id like to see a better system in place for this, in combination with AD useraccounts.