I am having the same issue. A proxy account has been added to the dbcreator role for the purpose of restoring a database via SSIS. However, that proxy cannot create database principals because it does not have access in the database it just restored. I don't want to grant the proxy more access than is absolutely necessary.