My question regards the ability of an administrator to assign the System
Administrator security role to any user.
We want to give select users the ability to manage the business users for
our CRM instance. This includes creating user records, and assigning various
security roles to them. However, we don't want the person with this role to
have the ability to customise CRM forms and suchlike.
It seems though that we cannot prevent anyone with the the Assign Role
privilege from being able to assign any role (including System Administrator)
to anyone they wish, including themselves. Is there any way to reduce the
risk of this, by restricting the ability of a business administrator to only
assign roles of equal or lesser power than they already have?