cc @0xmarty may have ideas - he's our contract guru 😎
have you looked at OZ’s access control module? You can programmatically grantRoles with it too… https://docs.openzeppelin.com/contracts/4.x/access-control