Rename attribute for clarity
Add authorization.role/reassign function
Require client to provide root role id
Let client track root role(s)
First stap at authorization.permission model
Remove cruft
Rework wcdw.authorization with public API and add unit tests
Refactor to data all the things with rules
Decruftify
Use a single permission entity for all modes between role and resource