Players groups ('all', non-gm, arbitrary groupings)
User roles allocated to players (multiple roles per player possible). Default: admin, gm, player, observer
Permissions allocated to user roles.

Player having permissions being superset of permission of all his roles.