When a user adds an employee, the available security groups are based on the security group of the user adding it – they can only add to the same or lower security level.

This means if the user who is adding a new employee is level 4, they can only add new employees at level 4 and lower.