Simple RBAC permission

Users have roles and domains can allow actions for roles. If a domains
permission does not have roles Permission will bubble up the domains
tree until a permission has roles or the domain is root.