portal rolls - user administration

HI

can a user how control rolls asignment for other user

asign himself system admin ? or any other admin roll ?

If so is there a flag or something to prevent him from adding admin rights but still allowing him to give all other rolls ?

Thanks

Z