Description
Ordinarily, if you grant a user "Administer Users", they can do everything *except* change the roles (they don't even see the checkboxes). You could give them 'Administer Permissions', but that also allows them to do other things.
This module lets you set which roles they are allowed to enable for a user. Administrators still see the roles checkboxes in the usual place (below 'status' on /user/123/edit), but everyone gets a new 'Roles' tab.
Works with D8 but not updated since April 2016.
Patches:
I'm not using any patches, but there are a couple RTBC-ed the queue.