It looks like we're going to want more encapsulation for Role/Permission assignment at the model level. A lot similar code was baked into the tests. In the recent refactor, I made role/perm generation more nimble within the test ecosystem, but not for the rest of the app. It seemed like a good idea at the time, but seeing how all of this had to be written again here suggests that it should live closer to the model. Once we start building out public features, we might see this type of code living in 3(!) places. 

This probably warrants further discussion, but I wanted to raise the issue now.