Further work on permissions with roles