and then you craft custom roles with distinct sets of permissions