The db_accessadmin fixed database role has permission to add and remove user IDs from the database. db_securityadmin manages role memberships and permissions, db_setupadmin manages configuration, and there is no db_sysadmin role (sysadmin is a server role, not a database role).