You can use sudo for that, by allowing certain commands to be run by the PI, eg.:<p><pre><code>  pi_account ALL= (root) groupadd course_*
  pi_account ALL= (root) usermod -a -G course_* *
</code></pre>
This would allow the PI to create groups with a certain prefix, and to add users to it.