Risk Terminator type safeguarding for GRC environment

I would like to know if there is any way in which a Risk Terminator type of functon can be added to GRC modules. In other words, can access to RA&R, CUP and ERM be organized any other way than assigning/removing the specific roles to the user in the UME. Furthermore is there a way in which the UME can be safeguarded from unauthorized role creation.