When someone is creating a customer, add permissions for them to be able to or not be able to assign other users as sales or bdc.