I thought server/grant.pp may have been a way add permissions to the role, but I can't see a way to interface with it from hiera