A new administrator needs to create user accounts and custom roles for a growing team, but the security team wants to grant only the least privilege necessary. The administrator should NOT be given the ability to manage grants across all objects in the account. Which system-defined role should be granted to this administrator to allow creating users and roles?