Let delegated admins assign roles without being able to grant DS Admin

We use a custom admin role so our operators can handle day-to-day user and group management, while organization-level settings like data retention stay locked down. The problem is how role assignment works. With "Edit Users & Groups", operators can't assign their own role to a new colleague. With "Edit Users, Groups & Administrator", they can, but they can also grant DS Admin to anyone. That means a deliberately restricted role can effectively create full administrators, which defeats the point of restricting it.

It would be great to have a way to limit which roles a delegated admin can assign. That could be an allow-list per custom role, an "assign roles of equal or lower privilege" option, or simply preventing anyone other than a DS Admin from granting DS Admin.

This matters for any organization with a tiered admin model, where a central team sets policy and operators handle daily tasks. It's also a least-privilege and separation-of-duties issue that auditors tend to care about.

If you've run into the same limitation, please upvote and tell us how you're working around it.