permissions as part of roles (unix like string appended to role after an @...(couchDB restrictions))