db_accessadmin
Members of the db_accessadmin fixed database role can add or remove access for Windows logins, Windows groups, and SQL Server logins.
Permissions of Fixed Database Roles
Security Considerations for Databases and Database Applications