Splitting this into (at least) two repos

[stuartpb]

This will probably have to happen: one is a module for just reading and applying permissions, and one is a module for presenting a UI for applying them.

[stuartpb]

I think the role UI is just going to have to be a script in the client code (one that gets loaded async).