Merged RBAC draft into authorization