Role grant permissions, with tests