Users registering new/changing existing Users or Authorisation groups should have full rights on Registration and no rights on Confirm.