CW-331 define all permissions per role - break down into topic permissions