How to set permissions to a particular role?

Question

I want to create an IT role. Superadmin should only create this IT role and enable or disable the permission for this role anytime (which roles this Superadmin can assign to the users), if this admin wishes to.​ IT role should not be permitted edit any of the users.

The Superadmin will decide which roles an IT person (IT role) can assign to users. Users with role IT role can not assign the roles above their position, this is a simple funda. For example, such users (with the IT role) cannot assign Admin role.

Superadmin designed the IT role in such a way that he can assign Forum Admin, Writer and Writer Admin. Hence, he can assign these roles he wish to.

Permissions to setup for IT roles:

• Such user can create a users.
• Such user can block or activate the users.
• Such user can assign the existing roles to the users he wants and can revoke it.
• Such user cannot delete.

Answer 1

Looks like you should try the Role Delegation module. Some details from its project page:

... allows site administrators to grant specific roles the authority to assign selected roles to users, without them needing the administer permissions permission.

For each role, Role Delegation provides a new assign ROLE role permission to allow the assignment of that role.

The module also adds an assign all roles permission. Enabling this permission for a role is a convenient way to allow the assignment of any other role without having to check all the assign ROLE role permissions on the permissions page.

Answer 2

In addition to @Pierre.Vriens answer, You can look at following modules to fine-tune your need, if you are dealing with multiple admin roles.

1. Administer Users by Role

This module allows site builders to set up fine-grained permissions for allowing "sub-admin" users to edit and delete other users — more specific than Drupal Core's all-or-nothing 'administer users' permission. It also provides and enforces a 'create users' permission.

2. Role assign

RoleAssign specifically allows site administrators to further delegate the task of managing user's roles while withholding the Administer permissions permission.

Both module has D7 and D8 version. In case what you are using.