Agents with 'Tickets in agent's groups' access rights have no user creation / update options

We've got several departments and these departments can't have access to each other tickets, because of privacy / AVG reasons.

Because of this, we've set the access settings for our agents on ‘Tickets in agent’s groups'.

This setting has several unexpected consequences:

• Agent can't create an enduser
• Agent can't change an enduser
  • Can't change it's name
  • Can't add a phone number
  • Can't change the language
  • Can't add a company
  • Can't add tags/details/notes

This is a problem in several cases.

• Not changing a endusers name results in every macro with requester.name will give the wrong name.
• When using dynamic content, it uses the incorrect language, since the agent is unable to change it. So the customer receives a message in the wrong language

Why is an agent unable to change any user field when using this setting? Even if the enduser has tickets only in groups of the said agent.