pub fn enforce_role_ceiling(
actor: &Identity,
requested_role: Role,
) -> Result<()>Expand description
Forbid a user from assigning a role with rank strictly greater
than their own. Same-rank is allowed so an Admin can re-save
another Admin’s record (already-existing target’s rank ladder is
covered by enforce_cross_rank_safe).