There seems to be a setting that can restrict a user from creating access groups (I have not bothered identifying it), but there isn't one to keep users from adding individuals to existing access groups. That is a bit counter-intuitive. Currently, any and all users can grant any of their contacts access to restricted content. Please add a permission to restrict this!
