Allow "start" and "end" UTC times to be specified on user accounts to specify when the user account is considered active. If the current time is outside of that window, the user account should be considered inactive.

Additionally, for each role that a user has, allow "start" and "end" UTC times to specify when the user should actively have that role. If the current time is within the "start" and "end" window, the user may be considered to have the role. Outside of the window, the user would not have the role.

Having spoken to andreas.nilsson@10gen.com about this, it may also make sense to introduce states for users (e.g. "deactivated", "active", "provisioned").