Logs every time a role is changed. Users get a Role History tab and there's a notification feature.
Should now work fine on D8, not personally tested it (earlier: 15 Sep 2018 - there's a dev branch, but when you install it complains about missing role entity, and drush updb does nothing)
Ordinarily, if you grant a user "Administer Users", they can do everything *except* change the roles (they don't even see the checkboxes). You could give them 'Administer Permissions', but that also allows them to do other things.
This module lets you set which roles they are allowed to enable for a user. Administrators still see the roles checkboxes in the usual place (below 'status' on /user/123/edit), but everyone gets a new 'Roles' tab.
Works with D8 but not updated since April 2016.
Patches:
I'm not using any patches, but there are a couple RTBC-ed the queue.