I've created a new role called "Head of Department" (HoD), which is based on the Course creator role but with extra capabilities turned on. I've configured the "Allow role assignments" page so that the HoD role can assign "lesser" roles (Course creator down to Authenticated user). Department heads are assigned the role at the system context and are therefore, I guess, allowed to assign roles at the system context. I don't want them to do this and, try as I might, I can't turn this off.
I've tried overriding the six role permissions for the front page only but that didn't make any difference (moodle/role:assign, and so on).
I've also tried preventing moodle/role:manage and moodle/site:doanything but this also has no effect.
Any help would be greatfully received... it's now beginning to drive me nuts !
Many thanks in advance,