Could do with a note about why permission checks are used for role access rather than iterating roles.