diff --git a/app/models/account_role.rb b/app/models/account_role.rb
index 3a98c0e..2e26e70 100644
--- a/app/models/account_role.rb
+++ b/app/models/account_role.rb
@@ -5,4 +5,14 @@ class AccountRole < ApplicationRecord
   belongs_to :role
 
   scope :active, -> { where(deleted_at: nil) }
+
+  validate :deleted_at_is_not_in_future
+
+private
+
+  def deleted_at_is_not_in_future
+    return if deleted_at.nil?
+
+    errors.add :deleted_at unless deleted_at <= Time.zone.now + 10
+  end
 end
diff --git a/spec/models/account_role_spec.rb b/spec/models/account_role_spec.rb
index 5868b6e..2280b3b 100644
--- a/spec/models/account_role_spec.rb
+++ b/spec/models/account_role_spec.rb
@@ -7,4 +7,23 @@ RSpec.describe AccountRole do
   it { is_expected.to belong_to :role }
 
   pending '.active'
+
+  describe '#deleted_at' do
+    def allow_value(*)
+      super.for :deleted_at
+    end
+
+    it { is_expected.to allow_value nil }
+
+    it { is_expected.to allow_value Faker::Time.backward.utc }
+    it { is_expected.to allow_value Time.zone.now }
+    it { is_expected.to allow_value 1.minute.ago }
+    it { is_expected.to allow_value 1.hour.ago }
+    it { is_expected.to allow_value 1.day.ago }
+
+    it { is_expected.not_to allow_value Faker::Time.forward.utc + 1.minute }
+    it { is_expected.not_to allow_value 1.minute.from_now }
+    it { is_expected.not_to allow_value 1.hour.from_now }
+    it { is_expected.not_to allow_value 1.day.from_now }
+  end
 end