Manage roles and per-staff permissions.
Grant or revoke a single capability for one staff member, without changing their whole role.