The created users may be given the administrator role.

To capture notes from the two PRs[1,2]. There are two methods how permissions can be scoped. Approach A is described in the steps to reproduce in this issue - user is granted permissions through roles not assigned to any organization, but belongs to a specific organization. Issue 38727 takes the other approach (approach B) - the user is granted permissions through roles assigned to organizations. In layman's terms it is "a user can do anything and belongs to a certain org" while the latter is "a user can do things only in a certain org and belongs to it.

In the context of this issue, approach A works for probably all Foreman resources, because all of those resources declare a default scope which limits the results to things belonging to the current organization and location. Katello resources do not do this. There are at least three approaches that could be taken:
1) Add a taxonomy-aware default scope to all katello resources
2) Declare a default autocompletion scope (similarly to what is done in a fix for [2]), but make it enforce taxonomy scoping instead of just checking permissions. Sadly katello doesn't seem to implement the same interface for this as Foreman
3) Make Authorizable#authorized be current taxonomy-aware instead of it being strictly permission-based as it is now

[1] - https://github.com/theforeman/foreman/pull/10197
[2] - https://github.com/theforeman/foreman/pull/10645