In Drupal 7 there is one permission for administering users, "Administer users".
This covers both the main user management page at 'admin/people/permissions', and the configuration of settings/fields for the user entity at 'admin/config/people/accounts' and 'admin/config/people/accounts/fields'.
A very common requirement for a site that's being released to a client is that they can administer the users (fair enough right?), so they need the "Administer users" permissions.
However, granting that permission also gives them access to edit the user entity settings/fields, which is very undesirable (no client should be able to change the underlying structure of the user once it's been set up, for obvious reasons).
This must be something a lot of people have to deal with...what methods/modules/custom code do people use to get around this limitation in the user module?