User role management? Custom claims apart from user metadata?

1.Hello i would like to be able to change roles from the dashboard or be able to somehow manage roles via an api but i see that i can only change password and some other claims.

2.A I would like to be able to add some more claims in the root of the jwt.For now i can only play with the user_metadata claim.
2.B If not 2A,then maybe add some way to secure user_metadata update operation. For instance let only admins update user_metadata but prohibit users even from updating their own user_metadata.

3.possibility to have a list of roles per user instead of just one?

thx! Have a nice day!