You'd largely be granting permissions via role, so that's the way to go