for the first question, i think it'll depend on your product and how you expect users to think about roles. at my old job the previous iteration matched what we were doing pretty well. I don't have a good sense of the performance difference between the two - it'll depend on the shape of your data and i know we've done some optimizations recently around intersections that should mitigate some of the difference. using self relations on the role definitions rather than wildcards should also help a little bit.