Function current_role_grants 

pub fn current_role_grants(grants: Vec<Grant>) -> Vec<Grant>

grants with each built-in role’s grants as role_rules defines them now, so a role’s rules have one definition and reach workspaces written before they changed.

A role the workspace holds any built-in grant of gets exactly the role’s current grants, on the workspace that grant names: a stored one the role still has is replaced by the current one in its place, keeping who gave it; one the role no longer has is dropped; one the role gained follows the role’s last stored grant, given by whoever gave its first. A role the workspace holds none of stays absent. Every other grant stays as it is, in order. A workspace already current comes back unchanged.