In reply to Rodolphe.

User permissions (roles and capabilities) are a dangerous thing to customize. I developed and maintained such a plugin for a decade and have seen every horror story imaginable, particularly from new users. Users would lock themselves out of their site. Users would grant permission to subscribers to create new administrators. All sorts of security problems. Putting that power into the hands of every WordPress user out of the gate would be a recipe for disaster.

In core, I would argue it's best to continue providing the basic option of allowing administrators to set user roles. There is still some risk in doing this for the uninitiated, but it is drastically reduced in comparison to opening the full API via a back-end interface. Anything beyond basic role assignment jumps into advanced user territory. Once a user reaches that level of understanding on how WordPress works, they can choose a plugin to manage permissions.