RBAC: decoupled rules from assignments and items, implemented php manager

See #499