you might have basic permissions (

view

resource,

edit

resource), but you could also have specialized ones like

can_comment

, which could/would be a combination of various roles