have you looked at OZ’s access control module? You can programmatically grantRoles with it too… https://docs.openzeppelin.com/contracts/4.x/access-control
I meant for an existing contract. Say there is a utility NFT already deployed, and I own token 42. I want to give your address permission to call doThing(42) on my behalf without transferring the token to you.