hmm, looks like I will have to write some higher-level language tool for pre-processing the schema, as even with few objects and permissions, an RBAC-style schema gets pretty huge.