You're right, this is getting really confusing. :confused: 
Probably this is not the best solution, but I want to show that we have a problem:

The RBAC model specifies that an identity can have multiple roles. This means that you need to **check all user roles** to determine if it is allowed. But this logic is actualy happening in the consumer module, not in the component itself.
That's the problem, the `Zend\Rbac` component currently depends on the user-land implementation to properly apply the concept of RBAC. This means that you can not use the `Zend\Rbac` directly without having to install a third party module.
I think a module should only provide **extra** functionality, should not be mandatory.