Implement which roles can grant/delete which roles from other users. The desired method of doing this is to make each role (member, admin, etc) a specific resource. Then assign permissions to create/delete the role from a user. This would allow role assignments to be enforced from the rbac Authorize function.

As a stop gap, just have a hard coded list that on admin role can grant/delete roles.