You need to have %1 or %2 privileges in the user permission set to update the state.', Comment = '%1 = SUPER; %2 = SECURITY'

Trying to setup a user that only can AddUser and assign User Group. In real life scenario the task to add new people to the system is delegated to some HR people. 

The SECURITY group has TOO MUCH permission as PAGE 0 (for instance) and let this employee to do so much more modification to the system.

 I think that this part is bad designed and should be refactored removing the HARDCODED Checks and letting to define users with the effective permission set level to perform only the desired task.

Another limitation that i can't understand is letting users assign PERMISSION SETS that they already own. in the scenario above and HR people should be granted to add people and assign permission based on company organization without being a system administrator