- Add GET /{id}/users endpoint for paginated role user listing - Add PUT /{id}/users endpoint for batch role user assignment - Use transaction to atomically sync user-role associations - Prevent modification of system role user assignments