Design a permission model

Draft — this page will cover: mapping real job roles onto grants, choosing group boundaries, and reviewing the result.