Yes. The code you provided works perfectly. Thank you.

However the option to self-promote still shows in the Secondary Roles section.

Can you provide a code fix for this as well?

I’ve found another security hole. The user has access to Users : Assign/Migrate where they can assign a user to theirs and other roles. How an I allow this user to use the User module and limit this user from the Assign/Migrate function?