Magento

Magento CE ver. 1.4.1.0

Here is the problem I got :

I created a new role with permision to create user , but not role.
This role don’t have permissions to many of the backend sections including magento connect.

When I created a user and assigned to this newly created role,

1. this user can create another user and when they go to user roles tab, they can assign the currently created user to Administrators.
2. this newly created user can access everything in the backend.

I guess this is a messed up implementation?

Do anyone else experience this problem?

Kindly advice.