if everything is going to be directly data driven, including how the permissions themselves are computed, then no, there isn't really a form of "rollback"