B2B application: users has its own users
Your approach is unnecessarily complicated. Your situation boils down to this:

You have users (also persons), with their corresponding attributes, including login credentials and such, but also status and last login date.
A user (person) can have one (or more?) role(s).
A role has one or more permissions.
A user can be created by one other user, so the user's creator is among the user's attributes.

So, I'd model three entities:

User (with all the properties), with a self-reference to the user's creator.
Role, with a many-to-many relationship to User.
Permission, with a many-to-one (or many-to-many) relationship to Role.

That's it.