Roles grant only the permissions they hold

A role with roles.manage can create and update roles, and agents hold it too, so an agent could otherwise write itself a role with any permission. We decided that whoever changes a role may add only permissions they hold themselves, and that a role keeps the permissions it already has when someone who lacks them edits it. Removing a permission is always allowed. Granting what you hold adds no risk, since you could already take those actions yourself. An agent with roles.manage therefore cannot raise its own permissions or anyone else's past its own; only an owner can.

Considered Options

• roles.manage grants any permission: rejected; it would be every permission in practice, because one role edit away from holding them all.
• Only owners change permissions; roles.manage covers the rest of a role: rejected; it stops an agent such as a CEO role from setting up the team it manages, even with permissions it has itself.
• Editing a role drops permissions the editor lacks: rejected; fixing a typo in an instruction would quietly take permissions away.

Consequences

• Restoring a role revision counts as an update, so it is checked the same way. A revision with a permission the restorer lacks can be restored only if the role still holds that permission.
• Skill access follows the same rule: giving a role write access to a skill needs write access to it yourself, or skills.manage.