Why: RDM needs a trusted, non-secret view of Backend-owned role policy without importing Backend internals or accepting a caller-supplied actor. Evidence: The full Backend test suite passed, including public-surface and provider contract tests. Impact: Adds optional extension surface 2.14 with actor-bound role snapshots and action decisions. Refs: Focused role and permission system task 4