Version Malachite brings the business roles and small changes in the roles's API (all important changes are in the changelog).
Business roles can be defined on role detail. Business role could contain sub roles - all sub roles are assigned automatically, when business role is assigned to identity.
Sub roles has the same validity as business role. When assigned business role is removed from identity, then all sub roles are removed automatically too. Sub roles are processed on the background asynchronously (by processors), only business roles (⇒ direct roles) are assigned synchronously.
More about this feature you can find here.