If Team Member Permissions > Group Access is set as 'Viewer', the user cannot edit groups, but they also cannot issue credentials. When Group Access is set to 'Editor' the user can then issue credentials, but can also edit and create groups. Feature request: to have a Group Access setting that allows team members to issue credentials, but prevents them from editing or creating groups.