Role-based access control that survives the fifth role

Conditionals on role names work until someone adds a role. Model permissions as data instead.