a role is just a bundle of permissions