He should then only be allowed to assign roles that are "lower" or equally to his roles. There is an issue about this: http://drupal.org/node/48544 sime schrieb:

But such a user could assign admin roles to himself, it's illogical?

Florian R wrote:

...

Is it possible that a user has:

+ The right to assign roles to other users + But not the right to edit the different roles

If i give a user the permission "administer users" the just can edit the profile but can't edit the roles of a user

If i give a user the permission "administer access control" the can edit the roles in the profile, but also can edit the "Access control"

Thanks, Florian

Many thanks, this was what iam looking for!