Function grant_as 

pub async fn grant_as(
    read: &Read,
    granter: &Permissions,
    role: RoleId,
    permission: &str,
) -> Result<RoleGrant>

Refuses a permission granter does not hold itself, so nobody widens a role past its own.