- Users should be able to revoke user roles. - After assigning user roles, they should be pending until the user who got the role assigned accepts it. - Alternatively, users should get informed when they got a user role assigned.