specced out how the RBAC functionality should work