Declarative roles block all runtime assignment mutations (ROL-1014) — need separation of definition vs membership immutability