If you assign a Role to a user/container/group with an expiration time,
how is that tracked?

I thought the nrfRequest object persists until the nrfEndDate comes
true. But Steve was suggesting that the nrfRequest objects are cleaned
up after 7 days?

Do these persist, past the cleanup, since they have an endDate?