A new administrator at your company needs to create user accounts and manage their login credentials, but should NOT be given the ability to manage object grants across the entire account or perform account-level configuration. Following Snowflake's principle of least privilege and the built-in role model, which system-defined role should this administrator be granted to create and manage users?