Enforces GrantForge policies in Elasticsearch with Elasticsearch's own roles: a service beside the cluster that keeps one role per user holding exactly what the service's signed policies give the user, with field and document level security where the license has them, in step with the policies, the users and the indices, and undoes changes made to those roles by hand. Native users carry the role among their own roles; users of other realms get it through a role ...