Permissions

Permission codes are the unit of truth — clients can create custom role labels but tasks/notifications fire by permission code