With the Roles module, you specify the where in the order status that the role will be granted (e.g. "Completed") set in admin/store/settings/products/edit/features once the Roles module is enabled. Using Workflow, you can check the contents of the cart and have it set the order status. In this case, you would have it check for a product containing the free role and set the order status to a intermediate status (e.g. "Pending Approval") It won't be until a store administrator reviews the order and set the status to "Completed" that the role will be granted. As long as a person's cart didn't contain the free role, every other product could be moved to "Completed" status where the role would be granted automatically.

As far as expiration, the role is removed after specified length of time, thus the user will no longer have any permissions that role grants. If you're using the Notifications module, users can be notified via email (set in admin/store/settings/notify/edit/role) when a role is about to expire. Otherwise, they will not be informed of any role expiration.