It is possible to define a privilege level on a Cisco router so that another user can run every command including the enable mode but not create or modify user accounts? How?
Actually the answer you selected is wrong: there is a way to do it locally.
It's called Cisco Views and you can tweak who can do what without the need for a server.
No. The privilege levels are predefined by Cisco and on the router itself there is not much in terms of editing that functionality.
What you can do though is setup TACACS and use that to authenticate. Then you can more easily define what functions certain accounts or groups can do. I do not have much experience with TACACS but I do know that accounts and groups are essentially role based and allowed certain functions based on assigned roles.
TACACS, I think, acts as the authenticator for people trying to login. So authentications are essentially passed to the server with TACACS installed.