Make role and group generics, like it has been done for user (+ various refactoring and cleanup)
Manage applications, with a non final implementation of per application permission filtering