Permissions

Map permissions to roles — wired post-MVP.