A role grant used to last until someone revoked it. That is right for a permanent editor. It is wrong for "I review these, I am out next week, can you cover until I am back?"
A grant can now carry an end date. Past that moment it authorizes nothing. There is no cleanup job and no sweep deleting rows. Each place that decides "does this token have this authority right now" simply leaves out a grant whose end date has passed. An expired grant is absent, not present but inert. Leave the date empty and nothing changes: every existing grant behaves as before.
On top of that sits a way to hand off a piece of your own authority. Setting up roles stays an administrator's job. Handing off is open to anyone who already holds real authority over something. You give part of what you hold to someone else, for one specific item and for a limited time: fourteen days by default, ninety at most. When the time runs out the delegation stops working, and there is nothing to remember to revoke. Revoking early works like revoking any other grant.
The rule that makes it safe is also the point: you cannot hand out authority you do not have. Before a delegation is created, Smeldr checks that you hold every operation the role carries, for that item.
The first version of that check looked only at the one operation named in the call, not at everything the role bundled. A person with a weak, common right could then have delegated something much stronger than they held. That was caught and fixed before release.
Delegating what you hold is a stricter promise than it first sounds, and it is the one this feature depends on.
Released in core v1.99.0 and mcp v1.41.0.