I do see what you're saying though, you'd still need all the

permissions

moved into the

role

definition if you were to take that approach