basically, you remove the idea of a

role

object type, and just have users be granted a particular relation on the repo itself