Role that can set roles but not change its own
It really sounds like there should be a module that does this ... I'm not aware of 1 offhand.

You could use hook_form_alter on the user account form and simply check the role of the logged in user. If they are Staff allow them to set roles to all but the Admin role you've defined. You would simply unset() the admin value in the $options array for the Roles checkboxes.

For example:

function MYMODULE_form_user_profile_form_alter(&amp;$form, &amp;$form_state, $form_id) {
  global $user;
  if (array_search('Staff', $user-&gt;roles)) {
    // Any RIDs you want to remove.
    unset($form['account']['roles']['#options'][3]);
  }
}


You would also probably want to add a validator to this form to check that a Staff user does not try to get around this by setting this value for instance via Firefox's Firebug. I leave that exercise to you.