Permissions

View/Edit/Approve access per role, per module. This records the access matrix that a role carries. Linking a specific logged-in user to one of these business roles, and enforcing the matrix on every page, isn't wired up yet — this is the configuration surface for that.