Add Role

Anyone holding this role gets these permissions. A user's own grants are added on top — nothing selected here can be taken away per-user.