Authorizer: transition roles & types for 'join'.