If you are not an Administrator, you cannot change any security groups that you are assigned to. The way round this is to have separate distinct groups assigned to all the Application and Security Roles and pages (let's say they start with AR, AP, SR and SP). By that I mean a security group for these functions is only assigned once. Then you have other security groups that inherit these AR, AP, SR and SP groups (lets call them UserRole groups). The user who is executing the BR has his/her own set of UserRole groups ie no one else has access to them. The standard users have a different set of UserRole groups. This should allow the executing user access to manage the groups without changing his/her own security. As far as I know, you cannot execute a BR using a different user.