Can I give roles temporarily to the user that is currently logged in?
You must grant the user the temporary roles when needed, and revoke the roles later.
You may grant temporary roles to the user on your Login action:
As an alternative, you may grant temporary roles to the user on the system event OnSessionStart. This event occurs after the end-user logs in to the application.
You can revoke the temporary user roles when the user logs out of your application.
Make sure to check whether the user still needs the temporary roles when he logs in again.
However, if there is no explicit logout from the user, the user will maintain the roles when he tries to log in. If needed, revoke the roles from the user during the next login.