Give the acltest user ZenManager on your restricted group.
As acltest, you can now add sub-organizers under the restricted group.
