In self-service request role page, the role catalog does not allow searching in "whole tree". Not even for administrator. So it looks like there should be an option for specifying a scope (one/subtree) - possibly configurable/restrictable using "roleManagement" section in System Configuration.
In Admin GUI it's possible to search in subtree, when Scope is set to "Subtree". This is missing in End user GUI.
Are there any security/performance considerations?