SOX compliant roles and user security

hello folks, as part of building sox compliant roles, we need to create a role (say, USER ADMIN) that, if given to a particular user, will allow them to:

a) insert/update/delete a user
b) insert/update/delete a role
c) assign/unassign roles to other users.
d) assign table/form/object access rights to roles.

This may sound a little strange, but that's what we need to achieve. A user with a role other than SUPER needs to do this.

we've had success creating other functionality-specific roles, eg GL POST, CUSTOMER MASTER MAINTENANCE, VENDOR MAINTENANCE, and we've done this by starting off with a role with no rights, and iteratively assigning rights as we attempt to perform the tasks in question, and noting which rights are required as they fail.

Crude, but effective.

This approach does not seem to work with user admin. If we throw any table or form that seems by name to be user related or security rated at this new USER ADMIN role, the result is still the same. The submenu items under the Tools... Security menu are still greyed out.

Can anyone point us in the right direction?