And where would you have the directory of permission files? In `lib/katello/permissions` ? That seems like a strange place to me since the permissions affect the web application i.e. `app/`. There exists no standard or consistency with how permissions are defined across plugins or within Foreman. I don't mind opening a discussion around how to structure this for consistency across Foreman and plugins but I am not seeing a compelling reason not to have them where they are now. 

This is how I look at it. Where do you go to find models? app/models. Where do you go to find controllers? app/controllers. Where do you go to find security policy? app/policies. The argument could be made, that right now we only have 'access control' or 'permissions' so the directory could be `app/permissions` or `app/access_control` but for me security policy is the broader concept given that *how* you guard various entities (routes, objects, etc) are your security policy while the permissions are just the vehicle.

Will a discussion suffice? I don't think that will get us what you want unless an issue is filed and someone tackles it. Will moving the `permission.rb` file that requires each permission into `lib/katello` satisfy?