5. Role and permission metadata APIs

[BryanttV]

Description

• Endpoints to extend/create (mapping directly to the document's contract):
  • List roles available in an existing scope.
  • Retrieve metadata and permissions for a specific role.
  • Retrieve metadata for specific permissions.
  • Assign/remove any role returned by the API (reusing the existing assignment endpoint, but verifying it has no fixed-role assumptions).
• Data source: these endpoints must read directly from the loaded definitions, not maintain a parallel copy.
• Response format: design the JSON response with the Administrative Console as the direct consumer — it likely makes sense to align the response shape with the fields defined in the ADR.
• Pagination/filtering: evaluate whether, given the expected number of roles/permissions per scope, pagination is needed, or whether a simple listing is enough for the MVP.

Concrete deliverable: a client (including the Admin Console) can retrieve all the information needed to list and describe a scope's roles/permissions without knowing in advance which ones exist.