Guys, what would be the most elegant way of modeling permissions for a back-office? Specifically, I’m wondering if I can avoid adding roles to the API of my user-facing app.