Add ISAC role management

docs/DESIGN_SYSTEM.md

@@ -209,6 +209,13 @@ Use the spacing tokens for new components. Prefer `8px`, `12px`, and `20px` gaps
   unrestricted administrative role; `Moderator` is reserved for community
   content moderation and does not imply ISAC access. Operational ISAC access is
   delegated separately through scoped roles and permissions.
+- Roles & Permissions is a separate User Operations registry. Role definitions
+  compose discrete capabilities through a dense permission catalogue with an
+  explicit selected count and textual `GRANTED` / `NOT GRANTED` states. The
+  built-in Admin role is visible but system-protected. Delegated access managers
+  must never be able to grant `system.admin`; both option visibility and
+  server-side validation enforce this boundary. Role mutations are recorded in
+  the audit log with their previous and resulting permission sets.
 - Account deletion uses a collapsed danger zone, explicit identity confirmation,
   and plain-language retention guidance. Soft-deleted accounts retain authored
   content under a deleted-agent identity while releasing credentials, usernames,