Valid roles to create user with

A manager can create a director user. That should not be possible and is a great vulnerability.