Design permissions schema

TODO: Guide to designing permissions with RBAC for common scenarios, with some opinionated guidance based on RBAC conventions.