Restrict user management in BCC

Sometimes we need to customize out of the box behaviour of BCC. Today I want to show how to restrict "user management" in BCC, only user with super admin role can manage "internal user", so the other users will not see the menu "Internal Users" in the "Personalization" tab, as it is shown on the image:

For implementing this task you need to change the next config files for publishing server:
...\atg\web\personalization\activity\genericActivities.xml:

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE generic-activities SYSTEM "dynamosystemresource:/atg/dtds/activitymanager/activitymanager_1.0.dtd">

<generic-activities>
  <activity xml-combine="replace">
    <id>personalization.internalUsers</id>
    <resource-bundle>atg.web.personalization.internalusers.WebAppResources</resource-bundle>
    <display-name-resource>personalization.internalUsers.displayName</display-name-resource>
    <description-resource>personalization.internalUsers.description</description-resource>
    <destination-page>
      <url>/AssetManager/assetManager.jsp</url>
      <clear-context>true</clear-context>
      <acl>Profile$role$epubSuperAdmin:read;</acl>
    </destination-page>
  </activity>
</generic-activities>

and  ..\atg\remote\controlcenter\service\internalUsers.xml

<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE applications SYSTEM "dynamosystemresource:/atg/dtds/application-configuration/application-configuration_1.0.dtd">

<applications>
  <application id="personalization.internalUsers" xml-combine="replace">
    <resource-bundle>
      atg.web.personalization.internalusers.WebAppResources
    </resource-bundle>

    <display-name-resource>
      personalization.internalUsers.displayName
    </display-name-resource>

    <destination-page>
      <url>
        /AssetManager/assetManager.jsp
      </url>
      <query-parameter value="-1" key="project"/>
      <query-parameter value="personalization.internalUsers" key="activity"/>
    </destination-page>

    <acl>
      Profile$role$epubSuperAdmin:read;
    </acl>

    <initializer>
    </initializer>

    <sort-priority>
      31
    </sort-priority>

    <category>
      internalExternalUsers
    </category>
  </application>
</applications>

Usefull links: Configuring BCC Home Page Security, Configuring the Asset Manager