I don't think individual development teams should be hosting this code in their own services. Instead, they should declaratively specify the rules on what roles

I don't think individual development teams should be hosting this code in their own services. Instead, they should declaratively specify the rules on what roles can do what, and rely on another layer to honor those requirements.