it should be a simple map from role to permission