Why? Who knows... I guess it's somewhere in the RoleManager.
When? on setting the new permissions --> obj.manage_permission