New roles for flexible permissions control