By default, project admins and the Jira system admin are allowed to add users and groups to project roles. To prevent that a project admin adds users to project roles that are not allowed to have a project role (e.g., customers), the Jira system admin can select groups whose users are potentially allowed to be assigned to project roles.
catworkx Restricted Role Assignment for Jira replaces the standard Jira dialog "Add users to a role" by a new one. With this new dialog only the Jira system administrator is allowed to add groups to roles. A project admin is only allowed to add single users to roles. The users and roles that are selectable in this dialog for project administrators are also limited by the Jira system administrator.
At the moment, you can obtain the catworkx Restricted Role Assignment app as JAR file only directly from catworkx.