Roles — TODO(PRODUCT_PACK): RBAC matrix