Private/Get-CommandRoleMap.ps1

function Get-CommandRoleMap {
    <#
    .SYNOPSIS
        Loads the command-to-RBAC knowledge base from disk.
    .DESCRIPTION
        Imports Data/CommandRoleMap.psd1 and caches it for the lifetime of the
        module session. Internal helper; not exported.
    .OUTPUTS
        System.Collections.Hashtable
    #>

    [CmdletBinding()]
    [OutputType([hashtable])]
    param(
        # Optional override path, primarily for testing.
        [Parameter()]
        [string]$Path
    )

    if (-not $Path) {
        $Path = Join-Path -Path $script:ModuleRoot -ChildPath 'Data/CommandRoleMap.psd1'
    }

    if (-not (Test-Path -LiteralPath $Path)) {
        throw "PSAutoRBAC command role map not found at '$Path'."
    }

    # Cache keyed by resolved path so test overrides do not poison the cache.
    if (-not (Get-Variable -Name 'RoleMapCache' -Scope Script -ErrorAction SilentlyContinue)) {
        $script:RoleMapCache = @{}
    }

    $resolved = (Resolve-Path -LiteralPath $Path).ProviderPath
    if (-not $script:RoleMapCache.ContainsKey($resolved)) {
        $script:RoleMapCache[$resolved] = Import-PowerShellDataFile -LiteralPath $resolved
    }

    return $script:RoleMapCache[$resolved]
}