once supported, you'll be able to write a schema to define a dynamic role that has zero or more permissions