diff --git a/app/models/account_role.rb b/app/models/account_role.rb
index 2e26e70..9e7f959 100644
--- a/app/models/account_role.rb
+++ b/app/models/account_role.rb
@@ -4,7 +4,17 @@ class AccountRole < ApplicationRecord
   belongs_to :account
   belongs_to :role
 
-  scope :active, -> { where(deleted_at: nil) }
+  scope :active, -> { not_deleted.not_expired }
+
+  scope :not_deleted, -> { where(deleted_at: nil) }
+
+  scope :not_expired, lambda {
+    where(
+      arel_table[:expires_at].eq(nil).or(
+        arel_table[:expires_at].gt(Time.zone.now),
+      ),
+    )
+  }
 
   validate :deleted_at_is_not_in_future
 
diff --git a/db/migrate/20190208062215_add_expires_at_to_account_roles.rb b/db/migrate/20190208062215_add_expires_at_to_account_roles.rb
new file mode 100644
index 0000000..d24fc4b
--- /dev/null
+++ b/db/migrate/20190208062215_add_expires_at_to_account_roles.rb
@@ -0,0 +1,7 @@
+# frozen_string_literal: true
+
+class AddExpiresAtToAccountRoles < ActiveRecord::Migration[6.0]
+  def change
+    add_column :account_roles, :expires_at, :datetime
+  end
+end
diff --git a/db/schema.rb b/db/schema.rb
index d376425..c00cde0 100644
--- a/db/schema.rb
+++ b/db/schema.rb
@@ -10,7 +10,7 @@
 #
 # It's strongly recommended that you check this file into your version control system.
 
-ActiveRecord::Schema.define(version: 2019_02_02_041009) do
+ActiveRecord::Schema.define(version: 2019_02_08_062215) do
 
   # These are extensions that must be enabled in order to support this database
   enable_extension "plpgsql"
@@ -21,6 +21,7 @@ ActiveRecord::Schema.define(version: 2019_02_02_041009) do
     t.bigint "account_id", null: false
     t.bigint "role_id", null: false
     t.datetime "deleted_at"
+    t.datetime "expires_at"
     t.index ["account_id", "role_id"], name: "index_account_roles_on_account_id_and_role_id", unique: true
     t.index ["account_id"], name: "index_account_roles_on_account_id"
     t.index ["role_id"], name: "index_account_roles_on_role_id"
diff --git a/spec/models/account_role_spec.rb b/spec/models/account_role_spec.rb
index 2280b3b..05c7c23 100644
--- a/spec/models/account_role_spec.rb
+++ b/spec/models/account_role_spec.rb
@@ -7,6 +7,8 @@ RSpec.describe AccountRole do
   it { is_expected.to belong_to :role }
 
   pending '.active'
+  pending '.not_deleted'
+  pending '.not_expired'
 
   describe '#deleted_at' do
     def allow_value(*)
@@ -14,9 +16,9 @@ RSpec.describe AccountRole do
     end
 
     it { is_expected.to allow_value nil }
+    it { is_expected.to allow_value Time.zone.now }
 
     it { is_expected.to allow_value Faker::Time.backward.utc }
-    it { is_expected.to allow_value Time.zone.now }
     it { is_expected.to allow_value 1.minute.ago }
     it { is_expected.to allow_value 1.hour.ago }
     it { is_expected.to allow_value 1.day.ago }
@@ -26,4 +28,23 @@ RSpec.describe AccountRole do
     it { is_expected.not_to allow_value 1.hour.from_now }
     it { is_expected.not_to allow_value 1.day.from_now }
   end
+
+  describe '#expires_at' do
+    def allow_value(*)
+      super.for :expires_at
+    end
+
+    it { is_expected.to allow_value nil }
+    it { is_expected.to allow_value Time.zone.now }
+
+    it { is_expected.to allow_value Faker::Time.backward.utc }
+    it { is_expected.to allow_value 1.second.ago }
+    it { is_expected.to allow_value 1.hour.ago }
+    it { is_expected.to allow_value 1.day.ago }
+
+    it { is_expected.to allow_value Faker::Time.forward.utc + 1.minute }
+    it { is_expected.to allow_value 1.minute.from_now }
+    it { is_expected.to allow_value 1.hour.from_now }
+    it { is_expected.to allow_value 1.day.from_now }
+  end
 end
diff --git a/spec/models/account_spec.rb b/spec/models/account_spec.rb
index 9e8487d..0692f8c 100644
--- a/spec/models/account_spec.rb
+++ b/spec/models/account_spec.rb
@@ -132,6 +132,46 @@ RSpec.describe Account do
         expect(result).to eq false
       end
     end
+
+    context 'before role expires' do
+      before do
+        account_role.update! expires_at: 2.seconds.from_now
+      end
+
+      specify do
+        expect(result).to eq true
+      end
+    end
+
+    context 'before role expires' do
+      before do
+        account_role.update! expires_at: Faker::Time.forward
+      end
+
+      specify do
+        expect(result).to eq true
+      end
+    end
+
+    context 'after role expires' do
+      before do
+        account_role.update! expires_at: 1.second.ago
+      end
+
+      specify do
+        expect(result).to eq false
+      end
+    end
+
+    context 'after role expires' do
+      before do
+        account_role.update! expires_at: Faker::Time.backward
+      end
+
+      specify do
+        expect(result).to eq false
+      end
+    end
   end
 
   describe '#add_role' do