There are a few registration form add-ons on Snowcovered that can do this, Alldnnskins' Login Combo is about as simple as it gets, but it really goes against the whole point of providing permissions if one leaves it to the users to choose and set their own access like that. How do you stop someone accessing things they aren't supposed to have.. and if they can then there's no point having the different permissions in the first place.

You could also use the built in-subscription functionality with RSVP codes to let people assign themselves to roles, but this is not very intuitive and would likely cost them and you more lost time than it would if the admin simply assigns people to special roles manually.

There's really no way around the fact that someone at some point has to be a gatekeeper for any new member who requires higher-than-normal access. I see this as legitimate admin work.

Rob