Access control
Roles and the permission catalog.
The permission catalog
Every permission a role can grant, with the label and grouping the roles
Roles with their grants
The three roles and what each currently grants. The grants come from the
Replace a role's permissions
Accepts **permissions and nothing else**, on purpose.