I like the roles approach (think I was one of those who suggested it), but I suspect it's quite a lot more effort to implement, since there's another layer of abstraction. This isn't a quick and dirty "use group filter groups for permissions" bodge. Which is probably a good thing, unless anybody is in a hurry to have this implemented Right Now.