- Add clearManagedAssignments, assignManagedRole, addUserToManagedGroup to interface - Update assignRoleToUser and addUserToGroup to explicitly set origin='direct' - Update getDirectRolesForUser to filter by origin='direct' - Implement managed assignment methods with ON CONFLICT upsert Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>