Relation roles

Created a pull request so we can review, discuss, and merge.
Ah. I see. Since we're changing the access callback, should we also just change the argument to list so it's an operation and not a permission? We could add a comment to explain instead...