If you want only the owner of a request to be able to add more users, you can protect the request.
To do this, select the request and choose Request/Task Request Protect .
The Remove Protection function can be used to remove this restriction.