With the write previlage, noticed that it's not allowed to generate supout.rif.you can already do this. make new user, and uncheck "policy" in his group:
http://wiki.mikrotik.com/wiki/Manual:Ro ... Properties
this will allow everything, except changing other users rights