Minor: refactor to group function logically
Ability to generate XML description of permissions
Fix permissions based on roles
Check access for create/update operations
Implement DELETE