The user management privileges provide the role with the top level security access to the database instance as the user administrator can assign any role to the user.

It would be great if the role assignment is delegated to the grantRole privilege and the createUser assigns a predefined role (perhaps per database) exclusively.