I like the approach to describe permissions but I also think that a good data model to sit behind this that includes roles and capabilities ultimately is needed in most applications. Users and use cases will almost always arise that require arbitrary roles with a mix of capabilities...