which is one of the advantages of the old style of doing things - the

role_binding

separates the "what is a user able to do on the object" from "which object are we talking about"