Broke roles into zones for cleaner configuration.  Adding more steps and hooks into the authorization workflow to support some of the more challenging situations.