Only Admin-level memberships add to anyone's reach. Giving an upstream role Admin over a child role puts the child on every upstream admin's keyring forever, so nest only when seniors should act inside the child; otherwise control a role through its supply, and hold people as members at a level.

It is the wiring convention that makes rotation exactly the roster and keeps the griefer set small.

Reach comes from one thing: holding admin over a node. Read and edit memberships add nothing to anyone's keyring.

So inviting a thousand editors adds nobody who can cut you off. An editor can still invite others, at or below their own level. Those invitations ride the editor's own strip, and die with it.

Now a choice. Wire Moderators in as an admin of Team X. Then everyone who was ever a Moderators admin holds a key to Team X. Forever. Rotating Moderators does not take it back.

Or keep Team X flat. Its admins are named people. Moderators holds only the cord that feeds it. Control from above is total but coarse: unplug the supply, wire a successor.

Nest when seniors should be able to act inside the junior role. Keep it flat when the role should be governed only as a whole. Nesting is permanent. Supply control is not.

One shape makes this hold. People are members of roles, at a level. The only certificates about a document itself are supplies. Then an ex-admin's reach is exactly the rosters they sat on.

Give admin only over things that can be rotated. And give it to people, not to roles.

Check yourself. Moderators is given Admin over Team X. Later Moderators is rotated. Do its former admins still have Team X on their keyrings?