Design out RBAC for EPR

[ninjamast3r]

Design how RBAC is going to work in the context of event/receiver/group interactions. Once we have a plan, spin off additional issues to tackle the pieces.

[caproven]

Not sure which form we'd like this design to take (markdown file? diagram?) but I'll document some thoughts. Going through our mutations..

Creating events

Should require permission for the receiver it references. Prevents manually-created events bypassing automation which should post to a receiver. Should there be a generic "create event" permission on top of this?

Creating receivers

Should require basic permissions. Doesn't interact directly with other types so don't see need for further complexity.

Creating receiver groups

Should require permission for all included receivers. Limits receiver & group composition scope, you can't compose groups of receivers you don't have access to.

This sounds nice on paper but I can't see much benefit. Should someone be able to create groups (and therefore automation) around arbitrary receivers?

Enabling / disabling receiver groups

Should require basic permissions.