Role-based access control

Granting permissions to roles and assigning people to roles, rather than granting rights person by person, so access can be reviewed and reasoned about.