Scenario: A custom permission level is created that doesn't have as many rights as the Site Owner role (Full Control permission) but, has more rights than a normal Contributor role (Contribute permission). The custom permission level does have the Manage Permissions permission enabled.
Problem: The user with the Manage Permissions permission is able to grant themselves or others Full Control. Thus circumventing that they were not actually added to the Site Owner group and giving themselves/others elevated permissions.
Goal: The goal is to allow these folks to manage permissions on their own site (lists, libraries, pages, etc.) but, not to allow them to have the Full Control of a Site Owner role. Nor should they be able to elevate their permissions or elevate other users' permissions beyond their own capabilities.
Suggestions on how to manage this situation?