Security owns derived roles; eligibility answers and queues rechecks

Context

Rule-based role membership is still a Security grant.

Decision

Eligibility supplies authorization answers and requests rechecks; Security alone maintains derived role assignments.

Alternatives Considered

Write role grants from eligibility: A second grant writer would split ownership of authorization guarantees.

Evaluate all role rules on every request: Repeated synchronous evaluation would add cost and availability dependencies to every request.

Consequences

Publication and record changes can request rechecks. Failed refresh leaves existing grants until their documented expiry. One missing use can fail a subject’s whole recheck batch.