seems like the decision to model a

role_binding

explicitly mostly just containerizes the permissions while keeping the relation definitions in the

role