Feature Request: create an user to manage only one organization

May be interesting to be able to manage only one organization using a dedicated account.

For example, a sortinghat administrator could delegate the affiliation tasks of a given organization to another person. With the current architecture, if I create a sortinghat user for another person, that person would be able to manage all the identities, which could lead to confidentiality or security problems. A way to let a user manage only the identities of an organization would be good.