content manager

Is it possible to create a security role that enables a user to add someone as a 'Browser' but nothing higher?

There is a security risk that only 'Content Managers' can assign permissions and they could assign users as 'Content Manager'

That is, it is too easy to lose control.