rbac cleanup

I still consider this a WIP, but I welcome comments. Ping @dclarizio, @h-kataria.