one phrasing of this that I could imagine is something like AWS or GCP IAM, where a role is a bundle of permissions but the permissions don't mean anything until they're tied to a resource