first pass at implementing qualified permissions granted by role membership