I've been here before Users allocating permissions beyond their own and the only solution offered was to vote for it as a feature request, which I did. But after 7 months there have only been 10 votes for it.
I can't understand how so few people find this a problem. You need to give someone the ability to add users and put them in a suitable user group, but you then give them a free pass to increase their own access permissions and potentially reduce the access permissions for me the prime admin, this can't be acceptable for any user management system.
I need to have an administrator role that can register users and put them into suitable groups, but not let that person manage the permissions for themselves or others.
The most obvious option is to separate "assign user groups" from "assign user groups and permissions"