Add tests for core permissions:
- admin (manage models)
- viewer (just view data)
- staff (no role authenticated user)