in the previous iteration, a "role" is just a bundle of permissions, and the role_binding is the thing that connects a role, a resource, and a user