How do you allow a role to assign other users roles - but only specific roles?
I think Role Delegation is what you're looking for.


  For each role, Role Delegation provides a new assign ROLE role
  permission to allow the assignment of that role.