Or maybe we can use boundaries to filter only those I have permission to assign to. Which would mean needing to set a reasonable default for that, and add a way to edit the boundaries of a user.
This is a bonfire demo instance for testing purposes
Manual federation enabled