it depends on how you intend to use these in your permissions checks; typically, you'd create objects to represent the environment or os, etc, and walk through them to grant/remove permissions