I don't have that strong opinion on that. My reasons are: 1) foreman consistency 2) I (personally) find it easier to modify one longer file so I see the context than searching the right file to edit when I need to add new permission, on the other hand, that's nothing that grep can't handle. Feel free to keep it split if you prefer.