Hmm. So if we go roles-based, every time you create a new role you'll get the full list of priv bundles in the Not In This Role column (and every time you tweak a role, you'll see a list likewise); plus there'll be a list/glossary of priv bundles hopefully both on the page itself (short version) and in a linked FAQ (longer version).

Which is obviously not to say you're wrong! Just that I'm still not quite grokking (which might well be me failing to recognise other's viewpoints because autism etc etc :-p) and it sounds like a fair bit of complexity for a thing I'm Not Grokking? I am perfectly happy to put it in the spec nonetheless if told to!