What role is able to grant role permissions on MSSQL 2016?
A restricted admin should only add users to roles through ALTER ROLE.  The ability to grant new permissions to a role or user should be reserved for a real admin.