Build a role registry with an immutable administrator and grants keyed by subject and role. A grant is active exactly when granted and current time is strictly below expiry. Only the administrator can grant/revoke; granting replaces expiry.

Reject zero subject, zero role and non-future expiry. Expose raw grant data separately from active status. Test expiry equality, renewals, revocation, unauthorized calls and cross-user isolation.

Preserve this explicit administrator design. Deliver a …