Fold privileges into roles