@tristantarrant I'm wondering if something like this would have been less verbose:

    <security enabled="true" roles="admin reader writer" />

Also, wondering if you need `enabled` at all. Couldn't you create a new role called `unsecured` or `all` which basically disables security altogether? You'd save an extra attribute.