Limit ability to assign role above a user’s own role

Is there a way to make it so, say, a custom role called Site Admin, which has a subset of Admin capabilities, can change the roles of lower capability users, but not further than Site Admin? Right now, the Site Admin can make another user an Admin, which has all the normal WordPress capabilities. This seems risky.

Thanks in advance.