staffaccess no longer controls whether a staff member can modify user permissions. That is now controlled by the permissions permission. The staffaccess description needs to be updated.
The description is not really false. When you don't have staffaccess, you can't change other staff member's permissions. I just verified this by giving myself all permissions but superlibrarian and staffaccess. I am not able to change permissions, but get prompted for authentication when I try. We could probably do a little better and display a nicer error with an explanation, like we do on the password reset page.
I would like to revisit this. Staffaccess, which lists modifying permissions as one of it's purposes is not accurate. If I set it, the staff member does not have this ability (which I am glad). I need to be able to give staff permission to change usernames and passwords without giving them keys to the whole system. The modify permissions should be removed. The permissions setting is what really allows this, and is independent of staffaccess. As is, these settings are confusing. Removing modify permissions from staffaccess seems to be the logical choice. If not, please provide an explanation why it needs to remain on the description of this setting.