diff --git a/src/main/java/com/klaroworks/runtime/role/RoleValidator.java b/src/main/java/com/klaroworks/runtime/role/RoleValidator.java
new file mode 100644
index 0000000..0b20259
--- /dev/null
+++ b/src/main/java/com/klaroworks/runtime/role/RoleValidator.java
@@ -0,0 +1,94 @@
+package com.klaroworks.runtime.role;
+
+import java.util.Collection;
+import java.util.Collections;
+import java.util.HashSet;
+import java.util.Set;
+
+/**
+ * Validates role context and permission requests against configured rules.
+ */
+public final class RoleValidator {
+
+    private final Set<String> validRoles;
+    private final Set<String> validPermissions;
+
+    public RoleValidator() {
+        this(Collections.emptySet(), Collections.emptySet());
+    }
+
+    public RoleValidator(Collection<String> validRoles, Collection<String> validPermissions) {
+        this.validRoles = Set.copyOf(validRoles);
+        this.validPermissions = Set.copyOf(validPermissions);
+    }
+
+    public boolean isValidRole(String role) {
+        if (role == null || role.isBlank()) {
+            return false;
+        }
+        return validRoles.isEmpty() || validRoles.contains(role);
+    }
+
+    public boolean isValidPermission(String permission) {
+        if (permission == null || permission.isBlank()) {
+            return false;
+        }
+        return validPermissions.isEmpty() || validPermissions.contains(permission);
+    }
+
+    public ValidationResult validateContext(RoleContext context) {
+        if (context == null) {
+            return new ValidationResult(false, "Context must not be null");
+        }
+        if (context.getUserId() == null || context.getUserId().isBlank()) {
+            return new ValidationResult(false, "User ID must not be blank");
+        }
+        return new ValidationResult(true, null);
+    }
+
+    public ValidationResult validateRole(String role) {
+        if (role == null || role.isBlank()) {
+            return new ValidationResult(false, "Role must not be blank");
+        }
+        if (!validRoles.isEmpty() && !validRoles.contains(role)) {
+            return new ValidationResult(false, "Unknown role: " + role);
+        }
+        return new ValidationResult(true, null);
+    }
+
+    public ValidationResult validatePermission(String permission) {
+        if (permission == null || permission.isBlank()) {
+            return new ValidationResult(false, "Permission must not be blank");
+        }
+        if (!validPermissions.isEmpty() && !validPermissions.contains(permission)) {
+            return new ValidationResult(false, "Unknown permission: " + permission);
+        }
+        return new ValidationResult(true, null);
+    }
+
+    public Set<String> getValidRoles() {
+        return Collections.unmodifiableSet(validRoles);
+    }
+
+    public Set<String> getValidPermissions() {
+        return Collections.unmodifiableSet(validPermissions);
+    }
+
+    public static final class ValidationResult {
+        private final boolean valid;
+        private final String errorMessage;
+
+        public ValidationResult(boolean valid, String errorMessage) {
+            this.valid = valid;
+            this.errorMessage = errorMessage;
+        }
+
+        public boolean isValid() {
+            return valid;
+        }
+
+        public String getErrorMessage() {
+            return errorMessage;
+        }
+    }
+}