Fine grained user viewing

Is your feature request related to a problem?

We would love to make use of authentik's permission system for direct administration of groups by group managers themselves, meaning group managers shall be able to use the authentik admin interface to manage group membership directly without being superusers.

This is already possible with authentik today.

But managers should not be able to see certain attributes of the user because the information is sensitive (following least privilege principles).

Describe the solution you'd like

I'd wish there would be finer grained viewing permissions for the global 'View User' permission.
Ideally each attribute and field (username, name, email) can be addressed individually, but the minimal version for me would be to limit viewing to the username itself as an option.

Describe alternatives that you've considered

For us the alternative would be to write a custom frontend that allows managers to manage group membership.

Additional context

We use authentik for our hackspace quite successfully for 3 years now. Authentik enabled us to grow significantly by making it easy to onboard new members to digital services.
This feature would really help us to get to the next step in terms of organization and self-governance.

No files or tests are named. Start by tracing the global “View User” permission and the admin interface paths for group membership management. Define how username-only or per-field visibility would interact with existing group-manager permissions, then verify that managers can manage membership without seeing restricted user attributes.