Only allow Site Directors to assign a passport above the level of Registered User, and make anyone who registers with a web site automatically be a "Registered User", rather than "Unassigned".
Subsite Directors have to be able to manage users, which currently means they are able to assign passports.
I have had a couple of Subsite Directors accidentally assign a new user the Site Director passport. Not cool. It also means they could make themselves a Site Director, and then lock me out. Also not cool.
Lee B commented
I don't understand why everyone is not automatically assigned as a registered user - would really like to not have the extra work of doing this.